CVE-2017-15393: Exposure of Resource to Wrong Sphere

Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak...

Archon Cross-Site Scripting Vulnerability

Archon is a system of online catalog sites for manuscript collections at the Maine Maritime Museum. A cross-site scripting vulnerability exists in the packages/core/contact.php file in Archon version 3.21 rev-1. A remote attacker can exploit this vulnerability to inject arbitrary web script or HT...

Design/Logic Flaw

packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503...

CVE-2017-17911: Improper Neutralization of Input During Web Page Generation

packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503...

CVE-2017-17911

packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request, aka Open Bug Bounty ID OBB-278503...

PT-2017-15095

Name of the Vulnerable Software and Affected Versions Archon version 3.21 rev-1 Description The issue concerns an XSS vulnerability in the referer parameter of an index.php?p=core/contact request, specifically in the contact.php file of the core package. Recommendations For Archon version 3.21...

Ed: Oauth flow on the comments widget login can lead to the access code leakage

Description Hello. Here is a keyword: frog I discovered an little Oauth flow in the comments widget authentication process using redirecturi manipulations. The widget located on the all blogposts, which have URL https://edoverflow.com/2017/post-title/ Upon authentication, it appeared that code...

CVE-2017-7851

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

Cross site request forgery (csrf)

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

CVE-2017-7851

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

CVE-2017-7851

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

PT-2017-17953 · D Link · Dcs-936L

Name of the Vulnerable Software and Affected Versions: D-Link DCS-936L versions prior to 1.05.07 Description: The issue is related to an inadequate CSRF protection mechanism. It requires the device's IP address to be a substring of the HTTP Referer header. Recommendations: For versions prior to...

CVE-2017-7851: Cross-Site Request Forgery (CSRF)

D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header...

The vulnerability of the login_mgrc.i program component in the DNR-320L, DNS-320LW, DNR-322L, DNR-326, and DNS-327L routers’ software allows a hacker to execute arbitrary code.

The vulnerability of the loginmgrc.cgi component of the DNR-320L, DNS-320LW, DNR-322L, DNR-326, and DNS-327L router microprogramming systems arises due to buffer overflows in the stack. Exploitation of this vulnerability allows an attacker to execute arbitrary code by creating specially crafted...

ManageEngine Applications Manager 13 - SQL Injection Vulnerability

Exploit for windows platform in category web applications ManageEngine Applications Manager version 13 suffers from multiple post-authentication SQL injection vulnerabilities. Proof of Concept 1 name= parameter is susceptible: POST /manageApplications.do?method=insert HTTP/1.1 Host:...

Redmine Information Disclosure Vulnerability (CNVD-2017-31956)

Redmine is a set of open source Web-based project management and defect tracking tools . The tool provides project management , issue tracking and role-based access control and other features . An information disclosure vulnerability exists in Redmine versions prior to 3.2.6 and 3.3.x prior to...

Cross site scripting

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."...

CVE-2015-5173

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."...

CVE-2015-5173

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."...

CVE-2015-5173

CVE-2015-5173 corresponds to a Cloud Foundry security issue described in connected advisories as a weak password recovery/expired reset mechanism affecting cf-release <216, UAA <2.5.2, and PCF Elastic Runtime