PayPal (Notify) - Bypass & Persistent Web Vulnerability

Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-21 Vulnerability...

Security Bulletin:IBM Security Guardium Big Data Intelligence (SonarG) is vulnerable to using Components with Known Vulnerabilities (CVE-2016-1000220, CVE-2017-11479)

Summary IBM Security Guardium Big Data Intelligence SonarG has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-11479 DESCRIPTION: Elastic Kibana is vulnerable to cross-site scripting, caused by improper validation of user-supplied input in Timelion. A remote attacke...

Schneider Electric U.motion Builder Cross-Site Scripting Vulnerability

U.motion Builder is a builder product from Schneider Electric France. A cross-site scripting vulnerability exists in Schneider Electric U.motion Builder, which allows attackers to exploit the vulnerability to inject malicious scripts and perform cross-site attacks...

CVE-2018-9186

A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...

PT-2018-4716

Name of the Vulnerable Software and Affected Versions backbone versions 0.3.3 and earlier Description The issue arises from a potential Cross Site Scripting vulnerability in the ModelEscape function. This vulnerability occurs when a user is able to supply input, and the output is then written to...

XSS Payload List - Cross Site Scripting Vulnerability Payload List

Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user...

Hackers Exploiting Drupal Vulnerability to Inject Cryptocurrency Miners

The Drupal vulnerability CVE-2018-7600, dubbed Drupalgeddon2 that could allow attackers to completely take over vulnerable websites has now been exploited in the wild to deliver malware backdoors and cryptocurrency miners. Drupalgeddon2, a highly critical remote code execution vulnerability...

Mitel ST conferencing component file upload vulnerability

Mitel ST is a video conferencing product from Mitel Canada. conferencing component is one of the conferencing components. A security vulnerability exists in the conferencing component of Mitel ST 14.2 GA28 and earlier versions. An attacker can exploit this vulnerability by sending a POST request ...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization of the paramValue variable found in AjaxRequestBuilder, allowing malicious scripts to be executed when the values are displayed...

digiac.ch XSS vulnerability

Open Bug Bounty ID: OBB-583764 Description| Value ---|--- Affected Website:| digiac.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-17790

Name of the Vulnerable Software and Affected Versions Learning and Examination Management System Script version 2.3.1 Description A Cross Site Scripting XSS issue exists, allowing for the execution of malicious scripts via a crafted message. Recommendations For version 2.3.1, update to a newer...

PT-2018-17452

Name of the Vulnerable Software and Affected Versions Kaspersky Secure Mail Gateway version 1.1 Description The issue is related to a Cross-Site Scripting XSS problem in the WebConsole of Kaspersky Secure Mail Gateway. This allows for malicious scripts to be executed in the context of the user's...

an1me.cc XSS vulnerability

Open Bug Bounty ID: OBB-516189 Description| Value ---|--- Affected Website:| an1me.cc Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure...

Cross-site Scripting (XSS)

angular is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on xml:base attributes, which allows the Firefox browser to render malicious scripts...

PT-2018-4252

Name of the Vulnerable Software and Affected Versions Symmetricom s350i version 2.70.15 Description The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving system logs, which is a cross-site scripting XSS vulnerability. This enables attackers to execute...

PT-2018-6607

Name of the Vulnerable Software and Affected Versions: MyCBGenie Affiliate Ads for Clickbank Products plugin versions prior to 1.7 Description: The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the border color parameter in the...

Huawei SmartCare dashboard module cross-site scripting vulnerability

Huawei SmartCare is an end-to-end user perception enhancement and assurance solution from Huawei, China, for improving customer experience in the telecom sector. dashboard module is one of the dashboard modules. A cross-site scripting vulnerability exists in the dashboard module in Huawei...

Cross site scripting

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

CVE-2017-15312

Huawei SmartCare V200R003C10 has a stored XSS cross-site scripting vulnerability in the dashboard module. A remote authenticated attacker could exploit this vulnerability to inject malicious scripts in the affected device...

Cross-site Scripting Vulnerability in JP1/Service Support and JP1/Integrated Management - Service Support

Overview A cross-site scripting vulnerability was found in JP1/Service Support and JP1/Integrated Management - Service Support. Impact Remote users can exploit this vulnerability to execute malicious scripts. Solution Please refer to the 'Vendor Information' section for the official countermeasur...