CVE-2017-8916

In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access...

CVE-2017-8916

In CIS-CAT Pro Dashboard, prior to version 1.0.4, an authenticated user can change an administrator’s email address and trigger a password-recovery email to themselves, thereby gaining administrative access. This is described in CVE-2017-8916 and corroborated by CNVD/CNVD-2018-05227 and other sou...

CVE-2017-8916: Weak Password Recovery Mechanism for Forgotten Password

In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access...

Visualizing Spectre/Meltdown Impact and Remediation Progress

In order to determine the impact of Spectre/Meltdown and track remediation progress across your entire environment, it is important to visualize vulnerability detections in a dynamic dashboard. For more information on Spectre and Meltdown, please see our previous blog. Using Qualys AssetView, we...

Concrete CMS: Stored XSS on Add Calendar

Greetings, There is no soup like crayons soup with vegetables. Hello @Concrete5 Team. Like my last report 300532 I found other Stored XSS vulnerability in your nice CMS. If you don't mind I will omit what Stored - XSS is and its description, hope everything is fine in your side about that :. The...

Huawei SmartCare dashboard module cross-site scripting vulnerability

Huawei SmartCare is an end-to-end user perception enhancement and assurance solution from Huawei, China, for improving customer experience in the telecom sector. dashboard module is one of the dashboard modules. A cross-site scripting vulnerability exists in the dashboard module in Huawei...

Automattic: Stored XSS in learnboost.com via the lesson[goals] parameter.

Summary --- learnboost.com is vulnerable to stored XSS via the lessongoals parameter. Browsers Verified In --- Mozilla Firefox 58.0b12 64-bit PoC --- The payload I used was: html Click F249206 POST /apps/lesson/update HTTP/1.1 Host: www.learnboost.com User-Agent: Mozilla/5.0 X11; Linux x8664;...

Zomato: [www.zomato.com] Privilege Escalation - Control reviews - /████dashboard_handler.php

Introduction The handler that controls all the ███ actions for reviews is accessible for any user. The following actions are thus being left open to anyone: getmanagerstatus read███████ unread██████████ ████████ feature██████ unfeature████████ moderate████ unmoderate█████ drop ███ sendmail...

CVE-2017-15312

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

Cross site scripting

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

CVE-2017-15312

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

CVE-2017-15312

Huawei SmartCare V200R003C10 is affected by a stored XSS vulnerability in the dashboard module. A remote authenticated attacker could inject malicious scripts into the affected device via the dashboard, enabling script execution in the user’s browser. The issue is documented across multiple recor...

PT-2017-13990

Name of the Vulnerable Software and Affected Versions Huawei SmartCare version V200R003C10 Description The issue is related to a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this to inject malicious scripts in the affected...

CVE-2017-15312: Improper Neutralization of Input During Web Page Generation

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

SDWAN 4000 SE- VWAN service is disabled automatically on SDWAN

MCN not working properly as the Virtual WAN Service got disabled itself. Dashboard showing the following error message: Error: Disabled by dpdkdaemon due to hardware initialization failure 4 times. The Citrix Virtual WAN Service was disabled...

Shopify: Bypass Filter and get Stored Xss

Description Shopify allows developers to create a special type of application called a "Sales Channel". Developers are allowed to upload a 16x16 SVG "Navigation Icon" for their app provided the SVG follows the design guidelines which limits the allowed elements and attributes. For some reason whe...

Deconf: Unauthenticated Reflected XSS in admin dashboard

The researcher has identified a Reflected XSS vulnerability within an analytics report of our plugin. The report was well documented, providing a step-by-step PoC to demonstrate the vulnerability...

CVE-2017-16961

A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack uses an admin/trees/add/process request with a...

PT-2017-14664

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.20 Description A SQL injection issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack involves an...

CVE-2017-16961: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack uses an admin/trees/add/process request with a...