CVE-2015-1164

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the PATHINFO to the default URI...

CVE-2015-1164

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the PATHINFO to the default URI...

EUVD-2015-1203

Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header...

CVE-2014-8029

Open redirect vulnerability in the web interface in Cisco Secure Access Control System ACS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, aka Bug ID CSCuq74150...

CVE-2014-6255

Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the camefrom parameter, aka ZEN-11998...

CVE-2014-9343

Open redirect vulnerability in modules/system/controller/selectlanguage.class.php in Snowfox CMS 1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the rd parameter in a submit action to snowfox/...

Syrian Electronic Army Hacks UK based Media Websites

Syrian Electronic Army SEA, a pro-hacker group supposed to be aligned with Syrian President Bashar al-Assad has again gain media attention by compromising a number of popular news websites and displayed a Thanksgiving popups informing people that they've been hacked. The Forbes, The Independent,...

Apple Offers Lukewarm Response to Masque Vulnerability

Apple said it is not aware of any customers affected by the Masque vulnerability disclosed earlier this week, and made no mention of a timeline when it might release an update patching the security hole. Masque is a vulnerability in iOS 7.1.1 and up that puts Apple mobile devices at risk to malwa...

Eleanor CMS Open Redirect

URL Open Redirect on Eleanor CMS Risk: Low CWE number: CWE-601 Vendor: eleanor-cms.ru Version: All Date: 11/11/2014 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Linux Ubuntu 14.04 ; Mozilla Firefox 33.0 Vulnerable File: go.php Exploit: +...

MIT Open Redirect

URL Open Redirect on WEBMAIL of Massachusetts Institute of Technology Risk: Low CWE number: CWE-601 Date: 11/11/2014 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Linux Ubuntu 14.04 ; Mozilla Firefox 33.0 Vulnerable File: go.php Exploit: +...

FastHealth.com CMS Open Redirect

URL Open Redirect on FastHealth.com CMS Risk: Low CWE number: CWE-601 Date: 04/11/2014 Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro ; Chrome 39.0.2171.42 beta-m Vulnerable File: goto.php Exploit: + http://www.FastHealth.com/goto.php?url=http://site.com PoC...

CVE-2014-8305

The CVE-2014-8305 entry concerns C97net Cart Engine prior to version 4.0, where the open redirect vulnerability exists in the redir function (includes/function.php). An attacker can cause a user to be redirected to arbitrary sites by supplying a URL in the HTTP Referer header to one of four pages...

IBM WebSphere Portal Open Redirect Vulnerability (PI19877)

The version of IBM WebSphere Portal on the remote host is affected by an unspecified open redirect vulnerability. This issue allows an attacker to perform a phishing attack by enticing a user to click on a malicious URL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

IBM WebSphere Portal 7.0.0.x Unified Task List Portlet < 6.0.1 Multiple Vulnerabilities (PI18909)

The version of IBM WebSphere Portal on the remote host is affected by multiple vulnerabilities in the Unified Task List UTL portlet : - An unspecified open redirect vulnerability exists that allows a remote attacker to perform a phishing attack by enticing a user to click a malicious URL...

IBM WebSphere Portal 8.x < 8.0.0.1 CF13 Multiple Vulnerabilities

The version of IBM WebSphere Portal on the remote host is affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the HttpClient component of the Apache HttpComponents library. An attacker can exploit this issue by sending a Proxy-Authorization header to retriev...

IBM WebSphere Portal 8.0.0.x Unified Task List Portlet Multiple Vulnerabilities (PI18909)

The version of IBM WebSphere Portal on the remote host is affected by multiple vulnerabilities in the Unified Task List UTL portlet : - An unspecified open redirect vulnerability exists that allows a remote attacker to perform a phishing attack by enticing a user to click a malicious URL...

Code injection

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // slash slash in a URL, which triggers a scheme-relative URL...

PYSEC-2014-4

The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // slash slash in a URL, which triggers a scheme-relative URL...

CVE-2014-0480

The CVE-2014-0480 issue affects Django’s core.urlresolvers.reverse, where insufficient URL validation allowed a crafted URL with // to generate a scheme-relative URL, enabling phishing via open redirect behavior. Affected Django versions: 1.4.x prior to 1.4.14; 1.5.x prior to 1.5.9; 1.6.x prior t...

Facebook Self-XSS Scam Fools Users into Hacking Themselves

Scammers have again targeted more than one billion active users of the popular social networking giant Facebook, to infect as many victims as possible. Not by serving fake post, neither by providing malicious video link, instead this time scammers have used a new way of tricking Facebook users in...