Claroline 1.11.8 Cross Site Scripting Vulnerability

Malicious users can inject JavaScript, HTML. and attacker can steal the session cookie and take over the account. Exploit Title: Claroline 1.11.8 Cross Site Scripting Date: 2013 11 October Author: Arsan Software Homepage: http://www.claroline.net Version : 1.11.8 Security Risk: High Tested on:...

Discuz x1. 5 to steal any of the user cookie-vulnerability warning-the black bar safety net

Just submitted 3 6 0 did not pass. And then I'll blog publishing. ! ! ! ! ! ! That is so, thank you all. Reprint please indicate the...

Amazon Linux AMI : curl (ALAS-2013-210)

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. C Tenable Network Security, Inc. The descriptive text and package checks ...

AlgoSec Firewall Analyzer 6.4 Cross Site Scripting

================================================================================================================================================================ AlgoSec Firewall Analyzer Version v6.4 cross-site scripting XSS Vulnerability...

PHPFox v3.4.1 XSS vulnerabilities

Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account, impersonating the user. It is also possible to modify the content of the page...

WordPress WooCommerce 2.0.12 Cross Site Scripting

WooCommerce 2.0.12 Persistent XSS Details ============================================================================== Product: WooCommerce 2.0.12 Security-Risk: High Remote-Exploit: yes Vendor-URL: http://www.woothemes.com/woocommerce/ Advisory-Status: NotPublished Credits...

MCImageManager - Multiple Vulnerabilities

MCImageManager - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/61825/info MCImageManager is prone to multiple security vulnerabilities. An attacker may exploit these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the...

vBulletin vBShout Cross Site Scripting

Exploit Title: vBShout vBulletin - Stored XSS Vulnerability Google Dork: intext:vBShout Date: 10.07.2013 Exploit Author: 0iZy5 Vendor Homepage: www.backtrack-linux.ro Software Link: http://www.dragonbyte-tech.com/vbecommerce.php?do=product&productid=2 Version: vBulletin 3.8.x, vBulletin 4.x.x,...

Caucho Resin - '/resin-admin/' URI Cross-Site Scripting

source: https://www.securityfocus.com/bid/60426/info Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting use...

DEBIAN-CVE-2013-1944

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL...

CVE-2013-1944

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL...

Design/Logic Flaw

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL...

CVE-2013-1944

CVE-2013-1944 is the tailMatch cookie handling flaw in curl/curl/libcurl where the tailMatch function in cookie.c does not correctly match path domains, allowing cookie leakage via suffix matches in URLs. Affected are curl and libcurl versions before 7.30.0. Multiple connected advisories (e.g., M...

curl: Cookie domain suffix match vulnerability

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL...

Road passenger Baba stored in plain text and any password get-vulnerability warning-the black bar safety net

Brief description: Password stored in plain text plus cross-site worms, you know Detailed description: Register road passenger Baba sent a message, the message content for the test code as /textareascriptalertdocumeng. cookie/script I registered two account xxoo2013 and xxoo2014, the password is ...

Atmail WebMail - searchResultsTab5?filter Reflected Cross-Site Scripting

Atmail WebMail - searchResultsTab5?filter Reflected Cross-Site Scripting source: https://www.securityfocus.com/bid/65408/info Atmail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execut...

HP Intelligent Management Center 5.1 E0202 Cross Site Scripting

Inshell Security Advisory http://www.inshell.net 1. ADVISORY INFORMATION ----------------------- Product: HP Intelligent Management Center Vendor URL: www.hp.com Type: Cross-Site Scripting CWE-79 Date found: 2012-06-08 Date published: 2013-03-04 CVSSv2 Score: CWE-79: 3,5 AV:N/AC:M/Au:S/C:N/I:P/A:...

Plogger - Multiple Input Validation Vulnerabilities

Plogger - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/58271/info Plogger is prone to following input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data: 1. An SQL-injection vulnerability 2. Multiple cross-site scripting...

discuz x1.5 x1.5.1 存储型xss（可定向攻击）

简要描述： discuz x1.5 x1.5.1 某处未过滤，形成存储型xss ，可窃取cookie。（很低调有木有。。） 详细说明： 添加好友的附言未作任何处理，导致可以插。 https://images.seebug.org/upload/201302/2521325724e668f21dd352d4830839e46dc461a6.png 对方点开提醒即生效。 https://images.seebug.org/upload/201302/2521353585462281cb56e45add569172a9842a85.png 漏洞证明：...

Mastery OA contents of the log stored XSS can get the cookie-vulnerability warning-the black bar safety net

Mastery OA2013 and 2 0 1 0 version, Office Anywhere 2 0 1 3 work log edit page there is the storage typeXSS, and their superiors view the log after you can steal the cookie 1, the work log edit page source code to bypass the bypass a character can be constructedXSS! ! ! 1, the interception to giv...