CVE-2016-9130: Improper Neutralization of Input During Web Page Generation

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The website name wasn't properly escaped when displayed in the campaign-zone.php script...

PT-2017-10145

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the improper escaping of the banner image URL for externa...

CVE-2016-9454: Improper Neutralization of Input During Web Page Generation

Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted non-admin account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages...

PT-2017-9967

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.3 Description The issue allows for persistent XSS attacks through the user interface, requiring a trusted non-admin account. A vector exists due to the website name not being properly escaped when displaye...

CVE-2017-6102

Persistent XSS in wordpress plugin rockhoist-badges v1.2.2...

CVE-2017-6103

CVE-2017-6103 affects the WordPress AnyVar plugin (v0.1.1). Connected sources describe a stored/persistent XSS vulnerability in AnyVar that can lead to execution of arbitrary script in a user’s browser and, per CNVD, potentially access cookie-based credentials. Exploitation details are not provid...

CVE-2017-6102

CVE-2017-6102 affects the WordPress plugin rockhoist-badges v1.2.2, with a persistent (stored) XSS flaw caused by insufficient input validation. Several connected sources describe this as an authenticated stored XSS vulnerability that could allow an attacker to execute scripts in a victim’s brows...

PT-2017-16897

Name of the Vulnerable Software and Affected Versions rockhoist-badges version 1.2.2 Description The issue is related to a Persistent XSS in the rockhoist-badges wordpress plugin. Recommendations For rockhoist-badges version 1.2.2, at the moment, there is no information about a newer version that...

CVE-2017-6103: Improper Neutralization of Input During Web Page Generation

Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1...

CVE-2017-6102: Improper Neutralization of Input During Web Page Generation

Persistent XSS in wordpress plugin rockhoist-badges v1.2.2...

PT-2017-15470

Name of the Vulnerable Software and Affected Versions Siemens RUGGEDCOM NMS versions prior to V1.2 Description A non-privileged user of the Siemens web application could perform a persistent Cross-Site Scripting XSS attack on port 8080/TCP and 8081/TCP, potentially resulting in obtaining...

CVE-2017-2683: Improper Neutralization of Input During Web Page Generation

A non-privileged user of the Siemens web application RUGGEDCOM NMS V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-Site Scripting XSS attack, potentially resulting in obtaining administrative permissions...

Elefant CMS 1.3.12-RC Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Elefant CMS 1.3.12-RC Fixed in: 1.3.13 Fixed Version https://github.com/jbroadway/elefant/releases/tag/ Link: elefant1313rc Vendor Website: https://www.elefantcms.com/ Vulnerability XSS Type: Remote Yes Exploitable:...

Bitrix Site Manager Cross Site Scripting

Hello list! There is Cross-Site Scripting vulnerability in Bitrix Site Manager. ------------------------- Affected products: ------------------------- Vulnerable was the last version of Bitrix Site Manager at 12.06.2015, when I found this vulnerability on web site of Russian terrorists. At that...

Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Vulnerabilities

Revive Adserver versions 4.0.0 and below suffer from cross site scripting, session fixation, and deserialization of untrusted data vulnerabilities. Revive Adserver 4.0.0 XSS / Deserialization / Session Fixation Applications affected: Revive Adserver Versions affected: = 4.0.1 Website:...

Courier Management System - SQL Injection

Courier Management System - SQL Injection Title : Courier Management System - Sql Injection and non-persistent XSS login portal Date: 17 January 2017 Exploit Author: Sibusiso Sishi [email protected] Tested on: Windows7 x32 Vendor: http://couriermanageme.sourceforge.net/ Version: not supplied...

Business Networking Script 8.11 Cross Site Scripting / SQL Injection

Exploit Title : ----------- : Business Networking Script v8.11- SQLi & Persistent Cross Site Scripting Author : ----------------- : Ahmet Gurel Google Dork : --------- : - Date : -------------------- : 16/01/2017 Type : -------------------- : webapps Platform : --------------- : PHP Vendor Homepa...

Business Networking Script 8.11 - SQL Injection / Cross-Site Scripting Vulnerabilities

Exploit for php platform in category web applications Exploit Title : ----------- : Business Networking Script v8.11- SQLi & Persistent Cross Site Scripting Author : ----------------- : Ahmet Gurel Google Dork : --------- : - Date : -------------------- : 16/01/2017 Type : -------------------- :...

PT-2016-7698

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA Switches versions 9.1.1-036 through 9.7.1-066 Description A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting XSS...

CVE-2016-9202: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Email Security Appliance ESA Switches could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting XSS attack against a user of the affected interface on an affected device. More Information: CSCvb37346...