JIRA puts a user's XSRF token in various resources.

h5.Steps to Reproduce: Log into JIRA Log out from JIRA h5.Expected Results: The URL shown in the address bar does not show the atltoken value h5.Actual Results: The URL shown in the address bar shows the atltoken value h5.Impact After checking with the security teams, this appears to be a low ris...

JIRA puts a user's XSRF token in various resources.

panel:bgColor=e7f4fa NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-61250. panel h5. Steps to Reproduce: Log into JIRA Log out from JIRA h5. Expected Results: The URL shown in the address bar does not show the...

MediaLink MWN-WAPR300N Insecure Session

MediaLink router MWN-WAPR300N - Several Vulnerabilities The vulnerabilities reported here are for the firmware version currently being shipped by Amazon.com. This is hardware version 2.0, firmware version V5.07.51enMDL01 . I have no knowledge of the behavior of previous versions of this router...

Unspecified Vulnerability in Oracle E-Business Suite Application Object Library Component

Oracle E-Business Suite E-Business Suite is the United States Oracle Oracle company's set of fully integrated global business management software. Oracle Application Object Library AOL, Application Object Library is one of the system management components. An unspecified vulnerability exists in t...

CVE-2016-3434

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via vectors related to Logout...

CVE-2016-3434

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via vectors related to Logout...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via vectors related to Logout...

CVE-2016-3434

CVE-2016-3434 affects Oracle E-Business Suite through the Oracle Application Object Library (AOL) in versions 12.1.3, 12.2.3, 12.2.4, and 12.2.5. The root cause is an unspecified vulnerability in the Logout subcomponent of AOL that could allow a remote attacker to compromise data integrity via th...

CVE-2016-3434

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via vectors related to Logout...

CVE-2016-3434

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via vectors related to Logout...

PHPmongoDB 1.0.0 - Multiple Vulnerabilities

PHPmongoDB 1.0.0 - Multiple Vulnerabilities Exploit Title: PHPmongoDB v1.0.0 - Multiple Vulnerabilities CSRF | HTMLor Iframe Injection | XSS Reflected & Stored Date: 14.04.2016 Exploit Author: Ozer Goker Vendor Homepage: http://www.phpmongodb.org Software Link:...

login.plu.cn XSS vulnerability

Vulnerable URL: http://login.plu.cn/user/logout?returnurl=https://www.openbugbounty.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 1...

georgieawards.ca XSS vulnerability

Vulnerable URL: http://georgieawards.ca/account/logout?returnUrl=javascript:alert/XSSPOSED/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1905041 Google Pagerank| 3 VIP website...

Uber: Session retention is present which reveals the customer info

Issue : Session retention is present at partner.uber.com which reveals all senstive data Steps to reproduce : 1Login to partner.uber.com under any driver profile 2navigate to summary page or any page e.g payment page 3logout the application 4press back button of the application application reveal...

pasion.com XSS vulnerability

Vulnerable URL: http://www.pasion.com/mis-anuncios/?logout//--alert/XSSPOSED/...

in.com Open Redirect vulnerability

Vulnerable URL: http://www.in.com/logout.php?r=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 20:41 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 2272 Google Pagerank| 5...

wowchina.com Open Redirect vulnerability

Vulnerable URL: http://www.wowchina.com/battlenet/logout?redirecturl=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 16:24 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank|...

login.schibsted.com Open Redirect vulnerability

Vulnerable URL: https://login.schibsted.com/logout?oauthtoken=uri=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0 VIP website status...

Drupal Login Disable Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Login Disable is one of the modules that provides login denial functionality. A security vulnerability exists in the Drupal Login Disable module in versions 6.x-1.1 prior to 6.x-1.x and...

CVE-2015-8082

The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the userlogout function, which allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module, as demonstrated by the CAS and URL...