Cross-Site Scripting Vulnerability in Times Enterprise Email System

Times Enterprise Email System is a cloud service email processing system for major enterprises. Times Enterprise Email System does not adequately filter the parameters at the mailbox login, and the attacker obtains the user's identity credentials such as cookies by constructing a special XSS code...

Knight Talent System V3.7 Exists Storage-based Cross-site Scripting Vulnerability

Knight Talent System is a professional talent system based on PHP + MYSQL as the core development, free + open source. The system has a high implementation efficiency, free switching of templates, flexible background management functions and many other excellent features. Knight Talent System V3....

Multiple Cross-Site Scripting Vulnerabilities in Fiyo CMS

Fiyo CMS is a content management system. Fiyo CMS fails to properly filter user-submitted "name" POST parameter data, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, obtaining sensitive cookies, hijacking sessions, or performing malicious...

eFront Learning CMS Cross-Site Scripting Vulnerability (CNVD-2016-03584)

eFront is an online learning system. A cross-site scripting vulnerability exists in eFront. Because the program fails to properly filter user-supplied input, an attacker can exploit the vulnerability to steal cookie-based authentication information and execute arbitrary script in the browser...

Netgear Router Cross-Site Scripting Vulnerability

The NETGEAR Router is the router device. A cross-site scripting vulnerability exists in Netgear Router Firmware version 1.0.0.24. An attacker is able to steal a cookie to intercept the session of a logged in user...

Adobe Analytics AppMeasurement for Flash Library Patch

Adobe today patched a vulnerability in the Adobe Analytics AppMeasurement for Flash library, which can be added to Flash projects to measure the usage of Flash-based content. The vulnerability is a DOM-based cross-site scripting flaw that can be abused for cookie theft, said researcher Randy...

MetInfo Cross-Site Scripting Vulnerability

MetInfo is an enterprise website management system with PHP Mysql architecture. MetInfo suffers from a cross-site scripting vulnerability. Allow attackers to insert malicious code, obtain user cookies, etc...

Zen Cart Shopping Cart App Plugs Big XSS Vulnerability

Popular open source shopping cart app Zen Cart is warning its users of dozens of cross-site scripting vulnerabilities found in its software. Affected websites, security experts say, risk exposing customers to malware, theft of cookies data and site defacement. Researchers at the security firm...

Drupal cross-site scripting vulnerability (CNVD-2016-01562)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal that could be exploited by an attacker to steal cookie-based authentication credentials and execute arbitrary script...

Cisco Adaptive Security Appliance WebVPN Portal Cross-Site Scripting Vulnerability

Cisco Adaptive Security Appliances ASA, Adaptive Security Appliances Software is a set of firewall appliances from Cisco USA. The device also includes IPS Intrusion Prevention System, SSL VPN, IPSec VPN, anti-spam and other features. A cross-site scripting vulnerability exists in the Cisco Adapti...

Magento CMS has multiple vulnerabilities

Magento is a professional open source PHP e-commerce system of the United States Magento company.Magento Community Edition CE is a community edition.Magento Enterprise Edition EE is an enterprise edition. Magento CE and EE in the existence of HTML injection vulnerabilities , brute-force cracking...

Bumble: Password modification without knowing actual password & httpOnly bypass

Two issues: Session cookie is returned in HTML source code of /encounters page, which would allow an XSS attacker to steal it, even if httpOnly is activated. A secret value, present in HTML source code of some api.phtml pages, can be used to modify user's password without knowing actual one...

InVision: CRITICAL ██████

STEPS TO REPRODUCE: 1. █████ 2. ███████ alertdocument.domain. 3. ███ █████ IMPACT - Using this vulnerability an attacker can steal cookies and authenticate as the victim and may compromise the user account...

Redaxo CMS HTML Injection Vulnerability

Redaxo CMS is an open source Web portal content management system CMS. The system supports custom modules , plug-in extensions , project backup and so on. HTML injection vulnerabilities exist in Redaxo CMS. Allow attackers to exploit these vulnerabilities to steal cookie-based authentication, tak...

Redaxo CMS SQL Injection Vulnerability

Redaxo CMS is an open source Web portal content management system CMS. The system supports custom modules , plug-in extensions , project backup and so on. SQL injection vulnerabilities exist in Redaxo CMS. Allows attackers to exploit these vulnerabilities to steal cookie-based authentication, tak...

Redaxo CMS Cross-Site Scripting Vulnerability

Redaxo CMS is an open source Web portal content management system CMS. The system supports custom modules , plug-in extensions , project backup and so on. A cross-site scripting vulnerability exists in Redaxo CMS. The vulnerability allows attackers to steal cookie-based authentication, take contr...

Enhancesoft osTicket HTML Injection Vulnerability

Enhancesoft osTicket is a free and lightweight PHP-based question return system from Enhancesoft, USA. The system supports e-mail queries and more. An HTML injection vulnerability exists in Enhancesoft osTicket, which can be exploited by attackers to execute arbitrary HTML or JavaScript code in t...

IBM WebSphere Application Server XSS Vulnerability (swg21974520)

IBM WebSphere Application Server is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Urban Dictionary: Cross-Site Scripting Vulnerability in urbandictionary.com

User can upload image for any definition available in urbandictionary.com. If anyone upload Invalid image file then you return a message through a url like this http://www.urbandictionary.com/cloudinarycors.html?error=Invalid+image+file Here the error parameter is vulnerable to xss. Impact When a...

Positive ZDsoft Employment Management System suffers from XSS Cross-Site Scripting Vulnerability

Positive ZDsoft Employment Management System is a website generation system. The Zhengfang ZDsoft Employment Management System suffers from an XSS cross-site scripting vulnerability. It allows an attacker to insert malicious js code into a page to obtain user cookies and other information, leadin...