CVE-2017-1000236

I, Librarian version =4.6 & 4.7 is vulnerable to Reflected Cross-Site Scripting in the temp.php resulting in an attacker being able to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000236

I, Librarian version =4.6 & 4.7 is vulnerable to Reflected Cross-Site Scripting in the temp.php resulting in an attacker being able to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000239

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000239

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

Cross site scripting

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000239

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000239

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000236: Improper Neutralization of Input During Web Page Generation

I, Librarian version =4.6 & 4.7 is vulnerable to Reflected Cross-Site Scripting in the temp.php resulting in an attacker being able to inject malicious client side scripting which will be executed in the browser of users if they visit the manipulated site...

CVE-2017-1000239: Improper Neutralization of Input During Web Page Generation

InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site Scripting resulting in allowing an authenticated user to inject malicious client side script which will be executed in the browser of users if they visit the manipulated site...

PT-2017-10929

Name of the Vulnerable Software and Affected Versions I, Librarian versions prior to 4.7 Description The issue allows an attacker to inject malicious client-side scripting, which will be executed in the browser of users if they visit the manipulated site, due to Reflected Cross-Site Scripting in...

Razer US: XSS on Saved Carts page

The saved cart endpoint was vulnerable to a reflective XSS due to lack of sanitization of cartcode which is inserted back in the HTML document, which could allow execution of malicious Javascript on the client...

HackerOne: Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page

Summary: Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page Description Include Impact: Since search query text can both include content of private vulnerabilities, it shouldn't be sent to Google Analytics. Furthermore, the information...

Design/Logic Flaw

A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or...

CVE-2017-14013

A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or...

CVE-2017-14013

A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or...

CVE-2017-14013

The CVE-2017-14013 issue is confirmed in ProMinent MultiFLEX M10a Controller web interface, where the logout function removes the user’s session only on the client side (Client-Side Enforcement of Server-Side Security). This allows potential bypass of protection mechanisms and identity impersonat...

CVE-2017-14013: Client-Side Enforcement of Server-Side Security

A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or...

PT-2017-6379

Name of the Vulnerable Software and Affected Versions Flexpaper versions prior to 2.3.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Swfile parameter. This can lead to the execution of malicious code on the client-side...

Design/Logic Flaw

osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication...

ProMinent MultiFLEX M10a Controller Authentication Bypass Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. An authentication bypass vulnerability exists in ProMinent MultiFLEX M10a Controller, where the logout feature in the application deletes a user's session on the client side only. An attacker can exploit the vulnerability to bypass...