2471 matches found
CVE-2018-9186: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header...
Potential XSS in "CSRF validation failure" page due to lack of referer sanitization
On FortiAuthenticator, a HTML page is returned to the user when the CSRF validation fails on referer mismatch. This page displays the faulty referer without sanitizing it. Therefore, in an attack scenario where the referer could be manipulated, the attacker could inject malicious scripts in the...
TP-Link TL-WR840N / TL-WR841N Authentication Bypass
Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...
TP-Link TL-WR840N/TL-WR841N - Authenticaton Bypass
Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...
Cloudflare: Remote file inclusion using "/cdn-cgi/pe/bag2?r[]="
Grampae was able to load arbitrary resources into an HTML response form. The following header parameters provided an HTTP request back although sometimes 30 minutes later: X-Forwarded-For Client-IP Referer Contact X-Wap-Profile Forwarded X-Originated-IP X-Client-IP From User Agent The resource...
Open-Xchange: Referer in /servlet/TestServlet
Hi. No encode referer URL in https://sandbox.open-xchange.com/servlet/TestServlet You check , but i think you need just replace Steps 1. Upload file 2. Change mimetype to "file":"filemimetype":"text/x-javascript" 3. Share to All or Link, but then need insert Iframe, same as in 342585 4. Make URL...
Rockstar Games: Smuggle SocialClub's Facebook OAuth Code via Referer Leakage
In this report, the researcher provided a POC in which they were able to combine two issues to create a condition that potentially could have allowed an attacker to obtain OAuth tokens. One of the issues involved allowing external content to load in our Screenshot Viewer tool; we resolved this...
PT-2018-3642
Name of the Vulnerable Software and Affected Versions sympa versions 6.2.16 and later Description The issue is related to an open redirection vulnerability in the referer parameter of the wwsympa.fcgi login action, which can result in open redirection and reflected XSS via data URIs. This can be...
CVE-2017-9280
Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposure of user sessions to untrusted third parties via proxies, referer urls or similar...
CVE-2017-9280
CVE-2017-9280 affects NetIQ Identity Manager Applications prior to 4.5.6.1. The vulnerability arises from session tokens being included in GET URLs, which can expose user sessions to untrusted third parties via proxies, referer URLs, or similar channels. The issue is documented across multiple so...
PT-2018-8502
Name of the Vulnerable Software and Affected Versions NetIQ Identity Manager versions prior to 4.5.6.1 Description The issue concerns the exposure of user sessions to untrusted third parties. This could occur via proxies or referer URLs due to the inclusion of session tokens in GET URLs...
WordPress WP Statistics plugin cross-site scripting vulnerability (CNVD-2018-04482)
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site.WP Statistics is one of the website statistical analysis plugin. A cross-site scripting vulnerability exists in...
userSpice 4.3 - Cross-Site Scripting
Application UserSpice PHP user management Vulnerability userSpice alert"1"&csrf=8b1339546d6af1e7536da0a705302e9c&updatebio= Vulnerable code: id?" class="nounderline"id?...
CVE-2017-15393
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...
CVE-2017-15393
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...
UBUNTU-CVE-2017-15393
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...
CVE-2017-15393
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...
CVE-2017-15393
CVE-2017-15393 affects Chromium/Chromium-based browsers, describing an information disclosure (referrer leak) in the Devtools remote debugging feature prior to 62.0.3202.62. A remote attacker could obtain access to remote debugging functionality via a crafted HTML page, enabling potential exposur...
CVE-2017-15393
Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...
