thepack.gamerlaunch.com XSS vulnerability

Vulnerable URL: https://thepack.gamerlaunch.com/recruiting/login.php?destination=INFOSEC.COM.BR"'- -! Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Facebook Covertly Launches A Photo-Sharing App In China

The Chinese market is no doubt a pot of gold for big technology giants with over 700 million internet users, but the Chinese government heavily controls the Internet within its borders through its Golden Shield project – the Great Firewall of China. The Great Firewall has blocked some 171 out of...

CVE-2017-9799

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

CVE-2017-9799

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure...

Jenkins 1.650 - Java Deserialization

Jenkins 1.650 - Java Deserialization import random import string from decimal import Decimal import requests from requests.exceptions import RequestException Exploit Title: Jenkins CVE-2016-0792 Deserialization Remote Exploit Google Dork: intitle: "Dashboard Jenkins" + "Manage Jenkins" Date:...

StoreFront 3.7 and Above - XenDesktop access policy rules cannot be applied on Endpoint

After implementing the steps mentioned in https://www.citrix.com/blogs/2015/07/01/rewriting-the-session-clientname-from-storefront/ , XenDesktop access policy rules cannot be applied on client name as the client host name comes up as WRXXXXX when using Receiver for web . The client name can only ...

Schneider Electric PowerSCADA Anywhere/Citect Anywhere Command Separator Improperity Vulnerability

PowerSCADA Anywhere is SCADA and power monitoring software.Citect is industrial automation operation and monitoring software. An improper command separator vulnerability exists in the implementation of PowerSCADA Anywhere 1.0 and Citect Anywhere version 1.0. An attacker in close network proximity...

Application launch using Anonymous user account resets the Session Limit Timer to 10

While launching an application for unauthenticated/Anonymous user, the idle tab for the Anon account might default back to 10 minutes even after manually setting it to some other value. The following steps can be followed to test the behavior: From a VDA running 7.9 or higher, run the below .exe ...

An SSL hostname is required but none was supplied

Attempting to launch application gives the error message : "Cannot start App" Storefront Reports the following error :"An SSL Hostname is required but none was supplied"...

CVE-2017-11195

Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element, if the value contains two quotes. It properly sanitizes quotes and tags, so one cannot simply close the src with a quote and inject after that. However, an attacker can...

prophet-questionnaire.com XSS vulnerability

Vulnerable URL: https://www.prophet-questionnaire.com/asp/P001385/launch.asp?=desktop=generic=1"...

Published Desktop not launching automatically via Netscaler

Desktop was not launching automatically via Netscaler. When tried internally, the desktop was launching automatically...

Error: "You have not chosen to trust...'' When Launching Applications Using Citrix Receiver Through NetScaler Gateway

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users may receive the following error when launching an application with Receiver for Windows 4.7,...

nike.com XSS vulnerability

Vulnerable URL: https://www.nike.com/at/launch/?nr=...

Xen Information Disclosure Vulnerability (CNVD-2017-06979)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. Xen has an information disclosure...

datenight.guildlaunch.com XSS vulnerability

Vulnerable URL: http://datenight.guildlaunch.com/recruiting/login.php?destination=test%22%27--!%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at 25.11.2017 Latest check for patch:| 25.11.2017 19:44 GMT Vulnerability type:| XSS Vulnerability status:|...

CVE-2017-8288

gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications but not interact with them, see information from the extensions e.g., what applications you have...

Command injection

gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications but not interact with them, see information from the extensions e.g., what applications you have...

CVE-2017-8288

gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications but not interact with them, see information from the extensions e.g., what applications you have...

Allowing communication from XenMobile apps to the Launch Darkly Service for feature flags

What are Feature Flags? Feature flags are a quality control measure for Citrix to be able to dynamically roll back to the previous working version of the app before a new feature was introduced. Since a bug fix on the public app stores is subject to delays due to app store submission and approval...