Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript innerHTML as used when generating login forms, 2 links or 3 resources URLs, and 4 the Display nam...

CVE-2012-2237

Summary: CVE-2012-2237 affects Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2, enabling remote XSS via multiple vectors (1) javascript innerHTML in login form generation, (2) links, (3) resources URLs, and (4) the Display name in profiles. The underlying issue is insufficient sanitization/encod...

CVE-2012-2237

Multiple cross-site scripting XSS vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 javascript innerHTML as used when generating login forms, 2 links or 3 resources URLs, and 4 the Display nam...

CVE-2019-15929

In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

DEBIAN-CVE-2018-19790

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the failurepath input field of login forms, an attacker can work around the redirection target restrictio...

Open redirect

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the failurepath input field of login forms, an attacker can work around the redirection target restrictio...

CVE-2018-19790

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the failurepath input field of login forms, an attacker can work around the redirection target restrictio...

PT-2017-12723 · Silverstripe · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: SilverStripe CMS versions prior to 3.5.5 SilverStripe CMS versions 3.6.x prior to 3.6.1 Description: The issue allows remote attackers to enumerate users via timing attacks due to response discrepancy in the login and password reset forms...

SS-2017-005: User enumeration via timing attack on login and password reset forms

More info at https://www.silverstripe.org/download/security-releases/ss-2017-005/...

U.S. Dept Of Defense: Content-Injection/XSS ████

Summary: Hi, It is possible to inject content and vulnerable to reflected Cross Site Scripting. Affected domain: https://██████████ Used browser: Mozilla. Impact One of the most common XSS attack vectors is to hijack legitimate user accounts by stealing their session cookies. This allows attacker...

Vulnerabilities in D-Link DAP-1360

Hello 3APA3A! There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This...

Allow cookie-less instance for security reasons

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-29687. panel Allow administrators to completely remove 'remember me' and disallow remembering usernames and passwords via HTML5...

FAA US Academy (AFS) - Auth Bypass Vulnerability

Document Title: =============== FAA US Academy AFS - Auth Bypass Vulnerability References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=171 Release Date: ============= 2012-01-27 Vulnerability Laboratory ID VL-ID: ==================================== 171 Common...

CVE-2011-4736

The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in loginup.php3 and certain other files...

OmniSecure v7.x DLX - Multiple SQL Injection Vulnerabilities

Document Title: =============== OmniSecure v7.x DLX - Multiple SQL Injection Vulnerabilities Release Date: ============= 2011-07-15 Vulnerability Laboratory ID VL-ID: ==================================== 101 Product & Service Introduction: =============================== One Click Folder Protecti...

OmniSecure v7.x DLX - Multiple SQL Injection Vulnerabilities

Document Title: =============== OmniSecure v7.x DLX - Multiple SQL Injection Vulnerabilities Release Date: ============= 2011-07-15 Vulnerability Laboratory ID VL-ID: ==================================== 101 Product & Service Introduction: =============================== One Click Folder Protecti...

USN-398-4: Firefox regression

USN-398-2 fixed vulnerabilities in Firefox 1.5. However, when auto-filling saved-password login forms without a username field, Firefox would crash. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Various flaws have been reported that allow an attacke...

sql injection in Logisense software

Background ---------- "LogiSense Corporation is a leading provider of performance software for service providers and enterprises. We offer a wide range of low-cost solutions designed to address common client billing and management, traffic congestion, network scalability, and latency issues."...