HackerOne: External URL page bypass

A specially crafted URL can bypass the external URL warning page. Details A url that starts with two forward slashes is treated as absolute by browsers. The markdown renderer refuses to render links that start like this, however it can be tricked by using a control character e.g. "test"...

phpMyAdmin 4.0.x < 4.0.10.10 / 4.2.x < 4.2.13.3 / 4.3.x < 4.3.13.1 / 4.4.x < 4.4.6.1 Multiple Vulnerabilities (PMASA-2015-2, PMASA-2015-3) (deprecated)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.10, 4.2.x prior to 4.2.13.3, 4.3.x prior to 4.3.13.1, or 4.4.x prior to 4.4.6.1. It is, therefore, potentially affected by multiple vulnerabilities: - An attacker cou...

MGASA-2015-0232 Updated phpmyadmin packages fix security vulnerabilities

Updated phpmyadmin package fixes security vulnerabilities: In phpMyAdmin before 4.2.13.3, by deceiving a user to click on a crafted URL, it is possible to alter the configuration file being generated with phpMyAdmin setup CVE-2015-3902. In phpMyAdmin before 4.2.13.3, a vulnerability in the API ca...

CVE-2015-0728

Cross-site scripting XSS vulnerability in Cisco Access Control Server ACS 5.50.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002...

CVE-2015-0727

Cross-site scripting XSS vulnerability in the HTTP module in Cisco Security Manager CSM 4.70SP11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789...

CVE-2015-0634

Cross-site scripting XSS vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310...

Cross site scripting

Cross-site scripting XSS vulnerability in the HTTP module in Cisco Security Manager CSM 4.70SP11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789...

CVE-2015-0634

Cross-site scripting XSS vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310...

CVE-2015-0727

Cross-site scripting XSS vulnerability in the HTTP module in Cisco Security Manager CSM 4.70SP11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789...

CVE-2015-0728

Cross-site scripting XSS vulnerability in Cisco Access Control Server ACS 5.50.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002...

XSRF/CSRF vulnerability in phpMyAdmin setup.

PMASA-2015-2 Announcement-ID: PMASA-2015-2 Date: 2015-05-13 Summary XSRF/CSRF vulnerability in phpMyAdmin setup. Description By deceiving a user to click on a crafted URL, it is possible to alter the configuration file being generated with phpMyAdmin setup. Severity We consider this vulnerability...

MacKeeper Remote Code Execution

A remote code execution has been reported in MacKeeper. By enticing the user to visit a specially crafted URL, a remote attacker could run arbitrary code on the victim's computer...

Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery

Manage Engine Asset Explorer 6.1.0 Build: 6110 - Cross-Site Request Forgery =============================================================================== CSRF/Stored XSS Vulnerability in Manage Engine Asset Explorer ===============================================================================...

CVE-2015-1908

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05, as used in Web Content Manager and other products, allows remote attackers to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05, as used in Web Content Manager and other products, allows remote attackers to inject arbitrary web...

CVE-2015-1908

Cross-site scripting XSS vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05, as used in Web Content Manager and other products, allows remote attackers to inject arbitrary web...

Unspecified Vulnerability in Drupal Amazon AWS Module

Drupal is a free, open source content management system developed in the PHP language maintained by the Drupal community.Amazon AWS is one of the modules that integrates with Amazon Web Services AWS. A security vulnerability exists in the Drupal Amazon AWS module prior to version 7.x-1.3, which...

Cisco FireSIGHT Management Center Web Framework HTTP Header Redirection Vulnerability

A vulnerability in the web framework of Cisco FireSIGHT Management Center could allow an unauthenticated, remote attacker to inject a crafted HTTP header that causes users to be redirected to a malicious website. The vulnerability is due to insufficient validation of user input before it is used ...

CVE-2015-3373

The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL...