1162 matches found
CVE-2016-5953
IBM Sterling Order Management transmits the session identifier within the URL. When a user is unable to view a certain view due to not being allowed permissions, the website responds with an error page where the session identifier is encoded as Base64 in the URL...
PT-2017-8831
Name of the Vulnerable Software and Affected Versions IBM Sterling Order Management affected versions not specified Description The issue concerns the transmission of session identifiers within URLs. When a user lacks the necessary permissions to view a certain page, the website responds with an...
JIRA Server can be DOSed through a specific error page resource.
JIRA had a specific error page resource that when repeatedly accessed could result in more memory being used eventually resulting in java running out of heap space...
JIRA Server can be DOSed through a specific error page resource.
JIRA had a specific error page resource that when repeatedly accessed could result in more memory being used eventually resulting in java running out of heap space...
JIRA Server can be DOSed through a specific error page resource.
JIRA had a specific error page resource that when repeatedly accessed could result in more memory being used eventually resulting in java running out of heap space...
Quora: [controlsyou.quora.com] 429 Too Many Requests Error-Page XSS
Summary: XSS on the error page when the user makes too many requests. Steps To Reproduce 1. Make a lot of requests to get the error 429 2. Open PoC in FireFox https://controlsyou.quora.com/'-alertdocument.domain-' HTTP Response ... ga'set', 'dimension1', 'board-'-alertdocument.domain-''; ga'set',...
CVE-2016-0378
IBM WebSphere Application Server WAS Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception...
LocalTapiola: Error Page Content Spoofing or Text Injection (viestinta.lahitapiola.fi)
Hi team! I want to report a context spoofing or text injection at the new scope added viestinta.lahitapiola.fi Vulnerability Description: The new scope allows users to inject any content on the 404 not found webpage Vulnerable Location:...
Yelp: Possible content spoofing due to missing error page
https://hackerone.com/reports/164137 , https://hackerone.com/reports/115284 ETC GO TO https://www.yelp.com/%0ATEXT%20INJECT...
ExpressionEngine: Reflective XSS
URL http://blackdoorsec.net/sandbox/express/admin.php?/cp/members/bans&search=&sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid&sortdir=desc URL Parameters /cp/members/bans search= sortcol=me%22%3E%3Cimg%20src=x%20onerror=promptdocument.domain%3Emberid sortdir=desc The...
Yelp: Error Page Text Injection
Hello Yelp team, Description : An attacker is able to inject his own text into error page and can fool the victim to visit his own malicious site. Please take a look at attached document, it contains POC as well as attack scenario about how the attacker can exploit this vulnerability and...
IBM WebSphere Application Server Liberty Information Disclosure Vulnerability
IBM WebSphere Application Server is an application server product developed and distributed by IBM in the United States, which is a platform for Java EE and Web services applications. IBM WebSphere Application Server The program fails to properly handle exceptions when the default error page does...
Cybozu Garoon fails to restrict access permissions
Overview Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon fails to restrict access permissions in the error page. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information...
Firefox Spoofing
The vulnerability of Firefox browsers is related to the incorrect installation of the "LINKABLE" and "URISAFEFORUNTRUSTEDCONTENT" flags, which are used for error pages. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks using specially crafted URLs...
Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page
Hello there , your site is vulnerable to phishing the users by this vulnerability. proof of concept...
Phabricator: Error page Text Injection.
AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...
Nextcloud: demo.nextcloud.com: Content spoofing due to default Apache Error Page
Hi ,I would like to report report a text injection and a miss-configuration of the 403 page which can be used in phishing. POC:...
bharathospitalityware.com XSS vulnerability
Vulnerable URL: http://bharathospitalityware.com/error.asp?msg=%3Cscript%3Ealert%27OPENBUGBOUNTY%27%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...
Zyxel ZLD OS Code Execution
Exploiting a vulnerability in the operating system of the Zyxel ZyWALL USG 300 network firewall/switch allows a malicious actor to inject any desired web script through the Referer header. This is done by improperly handling the “404” error page, thereby compromising the integrity of data process...