5053 matches found
IBM Security Directory Server Authorization Issues Vulnerability
IBM Security Directory Server is a suite of enterprise identity management software from IBM USA that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for authentication. An authorization issue vulnerability exists in IBM Security...
bootstrap: XSS in the tooltip data-viewport attribute
A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hosting W...
bootstrap: XSS in the affix configuration target property
A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...
WSO2 API Manager Cross-Site Scripting Vulnerability (CNVD-2020-60481)
WSO2 API Manager is a suite of API lifecycle management solutions from WSO2, Inc. WSO2 API Manager 3.1.0 suffers from a cross-site scripting vulnerability, which can be exploited to hijack a logged-in user's session by stealing a cookie, changing the logged-in user's password while maintaining...
CVE-2020-27885
Cross-Site Scripting XSS vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user’s session by stealing cookies which means that a malicious hacker can change the logged-in user’s password and invalidate the session of th...
CVE-2019-4563
IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...
Authorization
IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link an...
Stored cross-site scripting vulnerability in ZZCMS to***.php file
ZZCMS is a content management system. A stored cross-site scripting vulnerability exists in the ZZCMS to.php file. An attacker can exploit this vulnerability to obtain user cookie information...
CVE-2020-6876
A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module, a remote attacker could trigger an XSS attack when the user browses the web page. Then the...
Nagios XI 'Contact Templates' Cross-Site Scripting Vulnerability
Nagios XI is an IT infrastructure monitoring solution. The solution supports monitoring and alerting of applications, services, operating systems and more. Nagios XI 'Contact Templates' Cross-Site Scripting Vulnerability. The vulnerability can be exploited to execute arbitrary script code in the...
WordPress Plugin Colorbox Lightbox Cross-Site Scripting Vulnerability
WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site scripting vulnerability exists in the WordPress plugin Colorbox Lightbox. An...
Glassdoor: Reflected XSS at https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true via PATH
Summary: The endpoint https://www.glassdoor.co.in/FAQ/Microsoft-Question-FAQ200086-E1651.htm?countryRedirect=true is vulnerable to reflected XSS. Injecting any input in path will be reflected back without any sanitisation. Affected URL or select Asset from In-Scope:...
IBM Spectrum Scale Credential Theft Vulnerability
IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...
CVE-2020-4749
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...
U.S. Dept Of Defense: Reflected XSS www.█████ search form
Description: Reflected XSS vulnerabilities arise when the application accepts a malicious input script from a user and then this is executed in the victim's browser.Since the XSS is reflected, the attacker has to trick the victim into executing the payload, usually using another website. In this...
CVE-2020-15910
SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be...
CVE-2020-4749
IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure li...
Stored XSS Vulnerability in NineGuySoft's A8ERP Fashion Enterprise Resource Planning Management System
Jiu Jia Yi is an omni-channel retail solution provider for fashion companies. A stored XSS vulnerability exists in the A8ERP Fashion Enterprise Resource Planning ERP management system of Jiu Jia Yi Software. An attacker can exploit the vulnerability to obtain sensitive information such as user...
CVE-2020-16944
This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who...
