CVE-2020-4527

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie in TLS mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie an...

Stored cross-site scripting vulnerability in hybbs frontend fr***.js file

hybbs is a PHP web program that supports plugin extensions and template extensions. A stored cross-site scripting vulnerability exists in the frontend fr.js file of hybbs. Attackers can use the vulnerability to obtain sensitive information such as user cookies...

CVE-2020-4316

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecu...

Stored cross-site scripting vulnerability in ZZCMS z***.php file

ZZCMS is a free website builder developed in asp language. A stored cross-site scripting vulnerability exists in the ZZCMS z.php file. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...

Stored Cross-Site Scripting Vulnerability in Heybbs Micro Community se***.php Page

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. A stored cross-site scripting vulnerability exists in the Heybbs Micro Community se.php page. Attackers can use this vulnerability to obtain sensitive information such...

CVE-2020-4173

IBM Guardium Activity Insights 10.6 and 11.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecur...

CVE-2020-4173

CVE-2020-4173 affects IBM Guardium Activity Insights 10.6 and 11.0. The issue is that authorization tokens and session cookies are missing the secure attribute, allowing cookie values to be captured if a user visits an http link or a site containing one. Impact is exposure of cookies via network ...

lemlist: stored xss in app.lemlist.com

Hi there, I found a stored xss app.lemlist.com. Steps To Reproduce: 1. go to https://app.lemlist.com/. 1. create or edit campaigns. 1. visit tab Buddies-to-Be. 1. click Add one on the right Top. 1. Fill in the input 1. add / Icebreaker and companyName 1. click create . POC F901411 Impact Stealing...

NiterForum is vulnerable to XSS

NiterForum is a forum program. NiterForum suffers from an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

XSS cross-site scripting vulnerability in Youdiancms enterprise website management system of Changsha Youdian Software Technology Co.

Youdiancms Enterprise Website Management System is an enterprise website building system developed by Changsha Youdian Software Technology Co. An XSS cross-site scripting vulnerability exists in the Youdiancms enterprise website management system of Changsha Youdian Software Technology Co. An...

HCL Notes Cross-Site Scripting Vulnerability (CNVD-2021-13721)

HCL Notes is an email software from HCL India. The software supports access to emails, calendars, contacts and more. A cross-site scripting vulnerability exists in HCL iNotes. An attacker can exploit the vulnerability to obtain a user's cookie-based authentication credentials...

CVE-2017-1659

"HCL iNotes is susceptible to a Cross-Site Scripting XSS Vulnerability. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials."...

CVE-2017-1659

CVE-2017-1659 concerns HCL iNotes (HCL Notes) with a Cross-Site Scripting (XSS) vulnerability. The available documents describe that an attacker could exploit this to steal a user’s cookie-based authentication credentials. No explicit remediation, affected versions, or specific exploit details ar...

Engel & Völkers Technology GmbH: reflected xss in ██████

Summary: your subdomain : ██████ suffer from reflected xss bug that leads to execute javascript codes into browser Steps To Reproduce: add details for how we can reproduce the issue 1. visit : █████ 2. you will see popup and xss confirmed Supporting Material/References: █████ Impact An attacker c...

XSS Vulnerability in Ajang Cool Site Access Statistics System

Ajang Cool Site Visitor Statistics is a simple, easy-to-use site visitor statistics system. An XSS vulnerability exists in Ajang Cool Site Visitor Statistics System, which can be exploited by attackers to obtain user cookie information...

Stored Cross-Site Scripting Vulnerability at Gotrip Evaluations

Gotrip is a B&B Tourism Management System, implemented by the SSM framework. A stored cross-site scripting vulnerability exists in the Gotrip evaluation. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...

CVE-2020-6869

All versions up to 10.06 of ZTEMarket APK are impacted by an information leak vulnerability. Due to Activity Component exposure users can exploit this vulnerability to get the private cookie and execute silent installation...

XSS Vulnerability in ZZCMS Version 201910

ZZCMS is a free website builder developed in asp language. An XSS vulnerability exists in ZZCMS version 201910, which can be exploited by an attacker to obtain user's cookie information...

XSS Vulnerability at jfinal cms comment feeds

jfinal cms is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl, database with mysql, front-end bootstrap framework. jfinal cms feedback at the existence of XSS vulnerability , an attacker can explo...

EyouCms suffers from XSS vulnerability (CNVD-2020-32622)

EyouCms is a free + open source enterprise content management system developed on the core of TP5.0 framework. EyouCms XSS vulnerability , attackers can exploit the vulnerability to obtain user cookie information...