WordPress PopCash.Net Publisher Code Integration 1.0 Cross Site Scripting Vulnerability

WordPress PopCash.Net Publisher Code Integration plugin version 1.0 suffers from a cross site scripting vulnerability. Credit Ricardo Sanchez Vulnerable PopCash.Net Publisher Code Integration plugin 1.0 PopCash.Net Publisher Code Integration plugin is prone to a cross-site scripting vulnerability...

WordPress PopCash.Net Publisher Code Integration 1.0 Cross Site Scripting

Class Input Validation Error Remote Yes Reflected Yes Credit Ricardo Sanchez Vulnerable PopCash.Net Publisher Code Integration plugin 1.0 PopCash.Net Publisher Code Integration plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An...

WordPress Pootle Button 1.1.1 Cross Site Scripting

Class Input Validation Error Remote Yes Reflected Yes Credit Ricardo Sanchez Vulnerable Pootle button plugin 1.1.1 Pootle button plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

WordPress TR Easy Google Analytics 1.0.0 Cross Site Scripting Vulnerability

WordPress TR Easy Google Analytics plugin version 1.0.0 suffers from a cross site scripting vulnerability. Credit Ricardo Sanchez Vulnerable TR Easy Google Analytics plugin 1.0.0 TR Easy Google Analytics plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently...

PHP Melody Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes three 3 vulnerabilities found in PHP Melody version 2.7.3. PHP Melody is a “self-hosted Video CMS which evolved over the last 9 years. SEO optimization, unbeaten security and speed are advantages you no longer have to compromise on. A truly...

WordPress TR Easy Google Analytics 1.0.0 Cross Site Scripting

Class Input Validation Error Remote Yes Reflected Yes Credit Ricardo Sanchez Vulnerable TR Easy Google Analytics plugin 1.0.0 TR Easy Google Analytics plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage thi...

SUSE / Portus 2.2 Cross Site Scripting Vulnerability

SUSE/Portus version 2.2 suffers from a persistent cross site scripting vulnerability. Class Input Validation Error Remote Yes Stored Yes Credit rsanchezr Vulnerable SUSE/Portus 2.2 - https://github.com/SUSE/Portus Portus 2.2 is prone to a cross-site scripting vulnerability because it fails to...

Microsoft Exchange Server Cross-Site Scripting Vulnerability (CNVD-2017-32626)

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A cross-site scripting vulnerability exists in Microsoft Exchange Server 2016. A remote attacker can exploit this...

vBulletin Forum 'forum/help' Page XSS Vulnerability

vBulletin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Muviko 1.0 - (q) Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Muviko - Video CMS v1.0 – 'q' Parameter SQL Injection Date: 02.08.2017 Vendor Homepage: https://muvikoscript.com/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploi...

CVE-2017-9822

DNN aka DotNetNuke before 9.1.1 has Remote Code Execution via a cookie, aka “2017-08 Critical Possible remote code execution on DNN sites.” Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

WakaTime: JSON CSRF on POST Heartbeats API

Thanks @sp1d3rs! WakaTime API used JSON for communications and supported cookie-based authentication/CSRF protection on https://api.wakatime.com. Usually, JSON is CSRF-safe, but only when requests with content-type other than application/json gets rejected or additional CSRF protection is in plac...

Fortinet FortiOS Cross-Site Scripting Vulnerability (CNVD-2017-11806)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. A cross-site...

XOOPS <= 2.5.8.1 XSS Vulnerability

XOOPS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xoops:xoops";...

REST API attachment request still works with wrong/expired cookie

h3. Summary If you perform a REST API attachment request using Cookie Based Authentication with wrong/expired cookie it will still return results with 200 status code. h3. Environment JIRA v1000.892.2 h3. Steps to Reproduce Use Cookie Based Authentication using a wrong/expired cookie Perform a RE...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-05372)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS...

PT-2017-2833 · Citrix · Citrix Netscaler Sd-Wan +1

Name of the Vulnerable Software and Affected Versions: Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 Description: The issue exists due to insufficient input validation in the management interface component of Citrix NetScaler SD-WAN. This allows a remote attacker to execute arbitrary...

CVE-2016-0305

IBM Connections is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the U...

Drupal OpenLucius module cross-site request forgery vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.OpenLucius is one of the work management platforms for social communication, documentation and projects. A cross-site request forgery vulnerability exists in the Drupal OpenLucius modul...

Cross site scripting

IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web...