Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) Process Portal (CVE-2015-0106)

Summary IBM Business Process Manager and WebSphere Lombardi Edition are vulnerable to cross-site scripting, which is caused by the improper validation of user-supplied input. A remote attacker might exploit this vulnerability using a specially crafted URL to execute a script in a user's web brows...

Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) Process Inspector (CVE-2014-6173)

Summary Insufficient user input validation in IBM Business Process Manager's Process Inspector can lead to a cross-site scripting exposure. Vulnerability Details CVE ID: CVE-2014-6173 CVSS Base Score: 3.5 CVSS Temporal Score: See for the current score CVSS Environmental Score: Undefined CVSS...

Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) redirect-login mechanism (CVE-2014-6101)

Summary IBM Business Process Manager uses a mechanism to silently login users who have previously authenticated themselves. This mechanism is vulnerable to cross-site scripting attacks. Vulnerability Details CVE ID: CVE-2014-6101 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-si...

CVE-2018-11690

The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the...

PT-2018-10752

Name of the Vulnerable Software and Affected Versions Balbooa Gridbox extension versions prior to 2.4.0 Description The issue is caused by improper validation of user-supplied input, leading to cross-site scripting. A remote attacker could exploit this via a crafted URL to execute script in a...

CVE-2018-11688

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site,...

CVE-2018-11485

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...

Foxconn FEMTO AP-FC4064-T Weak Password Vulnerability

The Foxconn FEMTO AP-FC4064-T is a home base station device from Foxconn. A security vulnerability exists in the web administration page of the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15 version, which stems from the admin account using a weak default password: admin, and the...

CVE-2018-9112

A low privileged admin account with a weak default password of admin exists on the Foxconn FEMTO AP-FC4064-T APGTB385.8.3lb15-W47 LTE Build 15. In addition, its web management page relies on the existence or values of cookies when performing security-critical operations. One can gain privileges b...

Quixplorer 2.4.1 Beta Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Reflected XSS in quixplorer-2.4.1beta Google Dork: intitle:"My Download Server" Exploit Author: Adriano Marcio Monteiro @adrianomarcmont Exploit Author Site: https://www.brztec.com Exploit Author E-mail: email protected Vendor...

PT-2018-19482

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't provide CSRF protection when processing authenticated traffic using cookie-based authentication. This vulnerability is mitigated by the fact that an...

X (Formerly Twitter): Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requests

Summary: As part of our SoftwareLab@TU Darmstadt latest research project, we discovered a privacy-related vulnerability in multiple high-profile websites, including Twitter. An attacker exploiting this vulnerability can identify a user of your website while the user visits an attacker-controlled...

Atlassian Jira < 4.1.1 Multiple Vulnerabilities

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is prior to 4.1.1. It is, therefore, potentially affected by multiple vulnerabilities : - Remote authenticated attackers can exploit the privilege-escalation issue to gain SYSTEM-level...

WordPress Propertyhive 1.4.14 Cross Site Scripting Vulnerability

WordPress Propertyhive plugin version 1.4.14 suffers from a cross site scripting vulnerability. WordPress Propertyhive 1.4.14 Cross Site Scripting Vulnerability Vulnerable Propertyhive 1.4.14 Propertyhive is prone to a stored cross-site scripting vulnerability because it fails to sufficiently...

WordPress Propertyhive 1.4.14 Cross Site Scripting

Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Propertyhive 1.4.14 Propertyhive is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in...

WordPress Cross-Site Scripting Vulnerability (CNVD-2018-03957)

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress version 4.9.2, which can be exploited by an attacker to steal...

PHP < 5.6.33, 7.x < 7.0.27, 7.1.x < 7.1.13, 7.2.x < 7.2.1 Multiple Vulnerabilities - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

Zomato: [https://reviews.zomato.com] Time Based SQL Injection

@samengmg found an cookie based SQL injection on https://reviews.zomato.com. I noticed that two cookies were submitted during a request during the login page of https://reviews.zomato.com orange squeeze Due to the oddly named cookies, I decided to fuzz them. Eventually, I discovered both are...

WordPress Itinerary 1.0.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Credit Ricardo Sanchez Vulnerable Itinerary 1.0.0 Itinerary is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script...

WordPress Share This Image 1.03 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Credit Ricardo Sanchez Vulnerable Share This Image 1.03 Share This Image is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...