5565 matches found
Multiple HTML Injection Vulnerabilities in Fortinet FortiVoice
The Fortinet FortiVoice phone system is designed to provide a simple, affordable and user-friendly package for handling intelligent calls. Multiple HTML injection vulnerabilities exist in Fortinet FortiVoice. Because the program fails to properly filter user-supplied input, an attacker could...
Amazon Same Day Credential Shipping
FireEye has identified a campaign involving phishing websites that appear as legitimate Amazon sites. Amazon is the largest online retailer and threat actors frequently target its customers. In this attack, a person browsing the internet would be directed to authentic looking – yet fake – Amazon...
Imgur: Reflected XSS in m.imgur.com
There is a reflected XSS vulnerability in https://m.imgur.com as shown below: https://m.imgur.com/account/testcatplzignore%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3E/messages It appears that the username field in the url does not sanitize angle bracket characters on the mobile version...
Acer Portal app for Android SSL Certificate Validation Vulnerability
Acer Portal app for Android is a suite of Android-based portals for registering Acer products from Acer. A security vulnerability exists in Acer Portal app for Android versions 3.9.3.2003 through 3.9.3.2006 that can be exploited by remote attackers to impersonate Acer Cloud and obtain user...
The vulnerability of Trillian software allows a malicious attacker to compromise the confidentiality and integrity of protected information.
The vulnerability exists in Cerulean Studios Trillian due to the lack of verification of SSL certificates during MSN authentication. Exploiting this vulnerability allows malicious actors operating remotely to obtain MSN credentials by using a “man-in-the-middle” attack and replacing the SSL...
python-django-horizon: XSS in client side template
A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form for example, using an image's description,...
python-django-horizon: XSS in client side template
A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form for example, using an image's description,...
python-django-horizon: XSS in client side template
A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form for example, using an image's description,...
python-django-horizon: XSS in client side template
A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form for example, using an image's description,...
python-django-horizon: XSS in client side template
A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form for example, using an image's description,...
IBM Personal Communications Unauthorized Access Vulnerability
IBM Personal Communications is the United States IBM dedicated to Microsoft Windows host communications and terminal emulation software package, which provides virtual terminal VT emulation, system network architecture SNA and other functions. An unauthorized access vulnerability exists in IBM...
Microsoft Offers Pro-Tips on Avoiding Credential Theft
With the scourge of digital credential theft on the rise Microsoft is urging IT admin to button-up their networks and get serious about passwords and account security. The IT behemoth posted on Tuesday a best practices cheat sheet for administrators along with updating customers on some of the...
Cross-Site Scripting Vulnerability in Times Enterprise Email System
Times Enterprise Email System is a cloud service email processing system for major enterprises. Times Enterprise Email System does not adequately filter the parameters at the mailbox login, and the attacker obtains the user's identity credentials such as cookies by constructing a special XSS code...
CKEditor < 4.4.3 Preview Plugin Unspecified XSS Vulnerability
The preview plugin for CKEditor is prone to an unspecified cross-site scripting XSS vulnerability. Copyright C 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...
99 Problems but Two-Factor Ain’t One
Two-factor authentication is a best practice for securing remote access, but it is also a Holy Grail for a motivated red team. Hiding under the guise of a legitimate user authenticated through multiple credentials is one of the best ways to remain undetected in an environment. Many companies rega...
All Drupal Versions Open to Code Execution, Credential Theft Vulnerabilities
A number of issues exist in the content management system Drupal that could lead to code execution and the theft of database credentials via a man-in-the-middle attack, a researcher warns. The vulnerabilities lie in the way Drupal processes updates, according to Fernando Arnaboldi, senior securit...
Fortinet Cross Site Scripting
Exploit Title: fortinet.com Reflected XSS Credential stealer Date: 04/12/2015 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.fortinet.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: Fortinet sub-domains login domain Fortinet description :...
CVE-2015-7996
The Nitro API in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM SVM devices allow attackers to obtain credentials via the browser cach...
CVE-2015-7996
The CVE-2015-7996 issue affects Citrix NetScaler products (ADC, Gateway, SVM) where the Nitro API can expose credentials via browser cache. Affected versions include NetScaler ADC and Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service ...
CVE-2015-7996
The Nitro API in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58.11, and 10.5.e before Build 56.1505.e on NetScaler Service Delivery Appliance Service VM SVM devices allow attackers to obtain credentials via the browser cach...