8355 matches found
New Relic: Reflected XSS on Signup Page
Hello Team, I have found a reflected XSS on Signup Page i.e. on https://newrelic.com/signup. Please find the below details. Vulnerable URL: https://newrelic.com/signup Vulnerable Field: Your Email Address Vulnerable Parameter: email Parameter Type: POST Payload used: Browser used: Mozilla Firefox...
Error: "Cannot Complete Your Request" When Connecting to StoreFront
The following error is displayed when connecting to StoreFront: Cannot Complete Your Request New Experience Classic Experience...
tiendeo.us XSS vulnerability
Vulnerable URL: http://www.tiendeo.us/new-york-city-NY/search/1"confirm"XSSPOSED"" Details: Description| Value ---|--- Patched:| Yes, at 28.03.2016 Latest check for patch:| 28.03.2016 01:21 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 253169 Google Pagerank| ...
How Often Should You Scan Websites and Web Applications for Vulnerabilities?
Web Applications and Websites Exist in a Dynamic Environment There is no questioning the fact that the web application security landscape is in a constant state of flux. The pace of change is not only rapid but resembles a constant game of cat and mouse between hackers and security professionals...
chromium-browser: navigation bypass in Chrome Instant
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page NTP navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instantservice.cc and...
Google Chrome Instant Feature Security Restriction Bypass Vulnerability
Google Chrome is a web browsing tool developed by Google. A security vulnerability exists in versions prior to Google Chrome 48.0.2564.109 due to the Chrome Instant feature not ensuring that NTP navigation targets are in the most frequently viewed or suggested list. A remote attacker can exploit...
CVE-2016-1625
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page NTP navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instantservice.cc and...
CVE-2016-1625
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page NTP navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instantservice.cc and...
UBUNTU-CVE-2016-1625
The Chrome Instant feature in Google Chrome before 48.0.2564.109 does not ensure that a New Tab Page NTP navigation target is on the most-visited or suggestions list, which allows remote attackers to bypass intended restrictions via unspecified vectors, related to instantservice.cc and...
New Relic: open redirection at login
Hi guys, their is open redirection at login page if the user logged in he will be redirected directly if the user not logged in he will be redirected after the login URL : https://login.newrelic.com/login?returnto=http:example.com to reproduce go to...
New Relic: Potential Subdomain Takeover - http://storefront.newrelic.com/
Hi, The subdomain "storefront.newrelic.com" is currently pointing to Fastly, but is not registered to a service. Depending on whether Fastly permits it, a subdomain takeover similar to that of https://hackerone.com/reports/32825 could be possible. If the subdomain is not needed, it's recommended...
New Relic: [login.newrelic.com] XSS via return_to
The returnto parameter is not validated properly, which allows an attacker to execute javascript via the data: protocol: https://login.newrelic.com/login?returnto=data:text/html%3Bbase64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg%3D%3D Despite being executed not in the newrelic domain, the script still c...
New Relic: WordPress User Enumeration - blog.newrelic.com
Reporter was able to find an endpoint with the output of all authors. As this is publicly accessible information anyway, we don't consider this to be a security threat...
CVE-2016-2048
Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
DEBIAN-CVE-2016-2048
Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
CVE-2016-2048
Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
PYSEC-2016-14
Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
PYSEC-2016-14
Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
CVE-2016-2048
Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
The vulnerability of the Endian Firewall, which allows a hacker to execute arbitrary commands
The vulnerability of the Endian Firewall is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending metascripts through the NEWPASSWORD1 or NEWPASSWORD2 parameter in the cgi-bin/chpasswd.cgi file...