506 matches found
PT-2017-12415
Name of the Vulnerable Software and Affected Versions Cisco Meeting Server affected versions not specified Description A vulnerability exists in the Cisco Meeting Server, related to guest users joining meetings via hyperlinks. This issue allows an authenticated, remote attacker to enter a meeting...
CVE-2017-12224: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the...
Cisco Meeting Server Guest Hyperlink Information Disclosure Vulnerability
A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the...
CVE-2015-6942
Cross-site scripting XSS vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment...
CVE-2015-6942
Cross-site scripting XSS vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment...
CVE-2015-6942: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Coremail XT3.0 allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment...
PT-2017-7095
Name of the Vulnerable Software and Affected Versions Coremail version XT3.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a hyperlink in a document attachment. This can lead to the execution of malicious scripts on the client-side...
shop.hyperlink.ba XSS vulnerability
Vulnerable URL: http://shop.hyperlink.ba/product.php?item=19101%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 03.11.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...
Stored XSS in "gemirro" via injection in Gemspec "homepage" value
Stored cross-site scripting XSS vulnerability in Gemirro allows attackers to inject arbitrary web script via a crafted JavaScript URL in the "homepage" value of a ".gemspec" file. A ".gemspec" file must be created with a JavaScript URL in the homepage value. This can be used to build a gem for...
RSA Login Links Do Not Show as Hyperlinks in E-mail in Secure Mail
Secure mail app is unable to open hyperlinks from RSA site. The app is capable of opening other URL links but not this hyperlink. com.rsa.securid://ctf?ctfData=12345...... It shows up as regular text instead of a hyperlink...
Security vulnerabilities fixed in Thunderbird 52.1 — Mozilla
A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. A use-after-free vulnerability occurs during transaction processing in t...
Unpatched SMB Zero Day Easily Exploitable
In what’s turning out to be the zero day that keeps on giving, researchers are still finding ways to exploit an unpatched denial of service vulnerability that exists in the way Windows implements the Server Message Block protocol. Details around the bug aren’t a mystery. Laurent Gaffié, the...
RoundCube Webmail Cross-Site Scripting Vulnerability (CNVD-2016-13003)
RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in versions of Roundcube Webmail prior to 1.2.0. A remote attacker can exploit this vulnerability to inject...
Pushwoosh: Spoof Email with Hyperlink Injection via Invites functionality
Email Spoofing via hyperlink injection. Design Issue, Missing Best Practice, Low severity...
Apache OpenMeetings Event Description Cross-Site Scripting (CVE-2016-2163)
A cross-site scripting vulnerability has been reported in the event handling component of Apache OpenMeetings. The vulnerability is due to insufficient validation of input for event descriptions. A remote, authenticated attacker could exploit this vulnerability by scheduling an event with a craft...
New Relic: Hyperlink Injection on adding active users
@japz discovered an issue with how some email clients render text. This issue was determined to be very low or no risk and was subsequently removed from our program's scope...
Algolia: Hyperlink Injection in Friend Invitation Emails
Description A user can change their last name to a URL in order to send email invitations containing malicious hyperlinks. Steps to Reproduce 1. Create a new Algolia account with the last name http://example.com. 2. Navigate to My Account Referrral 3. Send an invitation to an email address that y...
Instacart: Hyperlink Injection in Friend Invitation Emails
Description A user can change their name to a URL in order to send email invitations containing malicious hyperlinks. Steps to Reproduce 1. Create a new Instacart account with the first name http://example.com 2. Navigate to https://www.instacart.com/store/referrals 3. Send an email invitation to...
WebSphere Application Server Header Injection
The vulnerability of WebSphere Application Server for application servers exists due to the lack of measures to address the CRLF sequence return with a line break. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP headers using a specially crafted URL...
Gratipay: User Supplied links on profile page is not validated and redirected via gratipay.
User Supplied links on profile page is not validated and redirected via gratipay. ==================== Description --------------------- The user profiles on gratipay has a profile statement section which is supported by markdown. An adversary can update the profile section with a hyper link URL ...