CVE-2017-1000431

CVE-2017-1000431 affects eZ Publish: versions 5.4.0–5.4.9 and 5.3.12 and older. The vulnerability is an XSS in the search module that could allow an attacker to inject scripts and potentially steal authentication credentials. The linked sources (e.g., ezpublish advisory and security pages) confir...

CVE-2017-1000431: Improper Neutralization of Input During Web Page Generation

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

ksby.com XSS vulnerability

Open Bug Bounty ID: OBB-458837 Description| Value ---|--- Affected Website:| ksby.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

ez-robot.com XSS vulnerability

Open Bug Bounty ID: OBB-452214 Description| Value ---|--- Affected Website:| ez-robot.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

ez-freebies.com XSS vulnerability

Open Bug Bounty ID: OBB-385237 Description| Value ---|--- Affected Website:| ez-freebies.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

ez-movie.com XSS vulnerability

Open Bug Bounty ID: OBB-322995 Description| Value ---|--- Affected Website:| ez-movie.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ez-net.co.kr XSS vulnerability

Vulnerable URL: http://www.ez-net.co.kr/new2012/product/list.php?cid=4"';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 322397 VIP website status:| No Check ez-net.co.kr SSL...

khq.com XSS vulnerability

Open Bug Bounty ID: OBB-178674 Description| Value ---|--- Affected Website:| khq.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

CVE-2015-8108: Undefined Security Weakness

The management interface in LenovoEMC EZ Media & Backup hm3, ix2/ix2-dl, ix4-300d, px12-400r/450r, px6-300d, px2-300d, px4-300r, px4-400d, px4-400r, and px4-300d NAS devices with firmware before 4.1.204.33661 allows remote attackers to obtain sensitive device information via unspecified vectors...

EZ Weather Plugin - FI - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application EZ Weather Plugin - FI published at the 'play' market has multiple vulnerabilities...

EZ Voice - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application EZ Voice published at the 'play' market has multiple vulnerabilities...

Wordpress EZ Portfolio 1.0.1 plugin - Multiple Persistant XSS Vulnerability

Exploit for php platform in category web applications Title : Wordpress EZ Portfolio 1.0.1 plugin - Multiple Persistant XSS vulnerability Author : ZwX Date : 22/02/2015 Downoload : https://downloads.wordpress.org/plugin/ez-portfolio.1.0.1.zip Vendor : http://webbisivut.org/ Level Security : Low...

Wordpress EZ Google Analytics Plugin 4.1.6 - Persistant XSS Vulnerability

Exploit for php platform in category web applications Title : Wordpress Plugin : EZ Google Analytics 4.1.6 - Persistant XSS vulnerability Author : ZwX Date : 15/02/2015 Downoload : https://downloads.wordpress.org/plugin/ez-google-analytics.4.1.06.zip Vendor : http://wordpress.ieonly.com Tested on...

WordPress Plugin EZ SQL Reports 4.11.37 - Multiple Vulnerabilities

WordPress Plugin EZ SQL Reports 4.11.37 - Multiple Vulnerabilities Exploit Title: EZ SQL Reports Proxy-Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Upgrade-Insecure-Requests: 1 User-Agent: Referer:...

EZ SQL Reports <= 4.11.33 - Authenticated Arbitrary Code Execution

There are several calls to "passtthru" in the code, one of them is receiving the username, password, database name and host from the $POST arguments, so you can inject in every of this parameter the ";" character or others like "&&" or "||" to execute other distinct commands to "/usr/bin/mysql"...

eZ Publish Detection

The script sends a HTTP request to the server and attempts to extract the version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

EZ Portfolio <= 1.0.1 - Multiple Cross-Site Scripting (XSS)

The EZ Portfolio Unmaintained WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...

WordPress EZ Portfolio Plugin <= 1.0.1 - Multiple Cross Site Scripting (XSS)

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

Ez Poll Hoster - Multiple XSS and CSRF Vulnerabilities

No description provided by source. ----------------------------------------------------------------------------------------------- Title: Ez Poll Hoster Multiple XSS and XSRF Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 14. December 2009...

Ez Cart 'sid' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37311/info Ez Cart is prone to is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...