PT-2015-2647

Name of the Vulnerable Software and Affected Versions RoundCube Webmail versions prior to 1.0.7 RoundCube Webmail versions 1.1.x prior to 1.1.3 Description The issue exists due to a lack of protection for the web page structure in the RoundCube Webmail component program/js/app.js. This allows a...

CVE-2015-8105: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in program/js/app.js in Roundcube webmail before 1.0.7 and 1.1.x before 1.1.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name in a drag-n-drop file upload...

CVE-2015-5733: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title...

Regular Expression Denial of Service

Overview Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse method. Proof of Concept var u = require'uglify-js'; var genstr = function len, chr var result = ""; for i=0; i=len; i++ result = resu...

MDM the mobile terminal management system of the SAP Afaria stored XSS vulnerability using process-vulnerability warning-the black bar safety net

Here, will demo on SAP Afaria, a world-renowned MDM mobile terminal management software for the vulnerability analysis,while the analysis of the network how could an attacker exploit the vulnerability to attack. The black bar safety net Wikipedia: what is MDM? In short, MDM is to help...

Deserialization Code Execution

Overview Versions 2.0.4 and earlier of js-yaml are affected by a code execution vulnerability in the YAML deserializer. Proof of Concept const yaml = require'js-yaml'; const x = test: !!js/function function f console.log1; ; yaml.loadx; Recommendation Update js-yaml to version 2.0.5 or later, and...

Reflected Cross-Site Scripting (XSS) in SourceBans

High-Tech Bridge Security Research Lab discovered vulnerability in SourceBans, which can be exploited to perform Cross-Site Scripting XSS attacks against web application users. The vulnerability exists due to insufficient filtration of input-data passed via the "advSearch" HTTP GET parameter to...

PT-2015-7345

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 47.0.2526.73 Opera affected versions not specified Description The issue is related to the improper implementation of certain map and filter operations for arrays in the js/array.js file of Google V8. This allow...

PT-2015-2164

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 41.0 Description The issue is related to the mishandling of certain receiver arguments in the js/src/proxy/Proxy.cpp component, which can be exploited by remote attackers to bypass intended window access...

CVE-2015-6969

Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...

PT-2015-7429

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0.2 Description A cross-site scripting XSS issue exists due to improper handling of user input in the 2k11 theme, specifically in the js/2k11.min.js file. This allows remote attackers to inject arbitrary web...

CVE-2015-6969: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...

CVE-2015-6920

Cross-site scripting XSS vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...

PT-2015-7404

Name of the Vulnerable Software and Affected Versions sourceAFRICA plugin version 0.1.3 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter in the js/window.php file...

CVE-2015-6920: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...

AnyMacro邮件系统存储XSS漏洞2(可盲打其它用户)

简要描述： 第一弹被忽略了，目测是厂商一直没关注wooyun，导致过期自动忽略的。 可以考虑直接转交给CNCERT处理 http://www.wooyun.org/bugs/wooyun-2010-0136531 详细说明： 据说乌云已经把它列入到通用型奖励厂商当中了。 0x01 背景 AnyMacro（安宁）成立于1999年，是国内领先的统一消息/移动门户/PushMail产品与应用解决方案提供商。主要客户涵盖国家部委、大型企业以及部分海外客户，客户分布于政府、军工、金融、电信、能源、教育等行业。...

WordPress Contact Form Generator <= 2.0.1 - Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications Live Demos. It is packed with a Template Creator Wizard to create fantastic forms in a matter of seconds without coding. copy of ´contactformgenerator.php´ file =================== TECHNICAL DETAILS =================== A CSRF issue was found i...

CVE-2015-2807

The CVE-2015-2807 issue affects the WordPress Navis DocumentCloud plugin, specifically versions before 0.1.1. The vulnerability resides in the js/window.php file where the wpbase parameter is used, enabling a reflected cross-site scripting (XSS) attack. An attacker can inject arbitrary script/HTM...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link...

PT-2015-5902

Name of the Vulnerable Software and Affected Versions Navis DocumentCloud plugin versions prior to 0.1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter in the...