9638 matches found
CVE-2018-13001: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...
CVE-2018-12903
In CyberArk Endpoint Privilege Manager formerly Viewfinity 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts-DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application...
Privilege escalation
In CyberArk Endpoint Privilege Manager formerly Viewfinity 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts-DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application...
CVE-2018-12903
CVE-2018-12903 concerns CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603. The vulnerability is a persistent cross‑site scripting (XSS) found on UI surfaces: the create token screen, VfManager.asmx SelectAccounts->DisplayName, user groups on ConfigurationPage, the Dialog Tit...
CVE-2018-12903
In CyberArk Endpoint Privilege Manager formerly Viewfinity 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts-DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application...
Magento - Filter Bypass & Persistent Web Vulnerabilities
Document Title: =============== Magento - Filter Bypass & Persistent Web Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1916 Videos: 4 x Proof of Concept https://www.youtube.com/watch?v=WIDwbSTCLQ https://www.youtube.com/watch?v=zaPRfvNQJzk...
CVE-2018-12903: Improper Neutralization of Input During Web Page Generation
In CyberArk Endpoint Privilege Manager formerly Viewfinity 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx SelectAccounts-DisplayName screen, a user's groups in ConfigurationPage, the Dialog Title field, and App Group Name in the Application...
PT-2018-11461
Name of the Vulnerable Software and Affected Versions CyberArk Endpoint Privilege Manager version 10.2.1.603 Description The issue concerns a persistent XSS vulnerability. It can be triggered via an account name on the create token screen, the VfManager.asmx SelectAccounts-DisplayName screen, a...
telekom.turtl.co XSS vulnerability
Open Bug Bounty ID: OBB-636625 Description| Value ---|--- Affected Website:| telekom.turtl.co Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
GhostMail - (Filename to Link) Cross Site Web Vulnerability
Document Title: =============== GhostMail - Filename to Link Cross Site Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1471 Release Date: ============= 2018-06-25 Vulnerability Laboratory ID VL-ID: ====================================...
Magento - Filter Bypass & Persistent Web Vulnerabilities
Document Title: =============== Magento - Filter Bypass & Persistent Web Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1916 Videos: 4 x Proof of Concept https://www.youtube.com/watch?v=WIDwbSTCLQ https://www.youtube.com/watch?v=zaPRfvNQJzk...
Gitlab -- multiple vulnerabilities
Gitlab reports: Wiki XSS Sanitize gem updates XSS in urlforparams Content injection via username Activity feed publicly displaying internal project names Persistent XSS in charts...
Design/Logic Flaw
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...
CVE-2018-12538
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's...
PayPal (Notify) - Bypass & Persistent Web Vulnerability
Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-22 Vulnerability...
Salesforce RegistrationForm - Persistent Web Vulnerability
Document Title: =============== Salesforce RegistrationForm - Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2054 Salesforce Security ID: 219513 Release Date: ============= 2018-06-22 Vulnerability Laboratory ID VL-ID:...
Magento application-side validation and bypass vulnerabilities
Magento is an open source e-commerce web application. An authentication and bypass vulnerability exists on the Magento application side, allowing remote attackers to bypass the authentication process of major magento tier 1 applications and execute malicious persistent scripts within them...
PayPal (Notify) - Bypass & Persistent Web Vulnerability
Document Title: =============== PayPal Notify - Bypass & Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1640 Video: http://www.vulnerability-lab.com/getcontent.php?id=1639 Release Date: ============= 2018-06-21 Vulnerability...
Salesforce RegistrationForm - Persistent Web Vulnerability
Document Title: =============== Salesforce RegistrationForm - Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2054 Salesforce Security ID: 219513 Release Date: ============= 2018-06-21 Vulnerability Laboratory ID VL-ID:...
Magento Products T1 - Bypass & Persistent Vulnerability
Document Title: =============== Magento Products T1 - Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1919 Release Date: ============= 2018-06-20 Vulnerability Laboratory ID VL-ID: ==================================== 19...