2471 matches found
PT-2017-11788
Name of the Vulnerable Software and Affected Versions Cacti version 1.1.12 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the cancel url variable. Recommendation...
Hopesys Web Management System version 1.0 /include/func.common.php referer header injection vulnerability
Hopesys website management system is based on LAMP development of enterprise/government website management system. Hopesys Website Management System version 1.0 /include/func.common.php referer header injection vulnerability. An attacker can use this vulnerability to obtain sensitive database...
SQL Injection Vulnerability in HTTP_REFERER on the Home Page of Uc365 Website Classifieds Navigation System
Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. There is a SQL injection vulnerability in the index.php file on the home page of the...
Serendipity < 2.1.1 Multiple Vulnerabilities
According to its banner, the version of Serendipity running on the remote host is prior to 2.1.1. It is, therefore, affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in the templates/2k11/admin/category.inc.tpl script due to improper validation of the...
ESPcms latest version has http header XSS vulnerability
ESSENCE ESPCMS website management system based on LAMP development and construction of the website management system. An http header XSS vulnerability exists in the latest version of ESPcms. The attacker triggers the cross-site vulnerability by modifying the Referer value to cross-site code...
ExpressionEngine: Open redirects protection bypass
Hello, When a redirect is to be issue on an ExpressionEngine instance, a request to the following URL is made: http://HOST/PATHTOEE/index.php?URL=TARGETURL Where TARGETURL is replaced with the actual URL we desire to redirect to. The script PATHTOEEDIR/system/ee/legacy/libraries/Redirect.php is t...
CVE-2016-3403
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...
CVE-2016-3403
Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Zimbra Collaboration before 8.6.0 Patch 8 allow remote attackers to hijack the authentication of administrators for requests that 1 add, 2 modify, or 3 remove accounts by leveraging failure to use of a CSRF token and...
CVE-2016-3403
Zimbra Collaboration Server (Admin Console) vulnerable to multiple CSRF flaws in versions before 8.6.0 Patch 8. CSRF tokens and referer header checks are not enforced, enabling remote attackers to hijack administrator sessions and perform add/modify/remove account actions (bugs 100885/100899). Re...
New Relic: CSRF For Adding Users
Issue The API affected is https://rpm.newrelic.com/accounts/accountid/accountviews. Only admin users are allowed to add other new users, but a normal user with knowledge of the accountid can craft a webpage which does a CSRF when an admin user visits it. There are 2 problems with it that can resu...
CVE-2017-2136
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...
CVE-2017-2136
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...
Cross site scripting
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...
CVE-2017-2136
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...
CVE-2017-2136
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...
CVE-2017-2136
CVE-2017-2136 (WP Statistics) affects the WordPress WP Statistics plugin, version 12.0.4 and earlier. The root cause is a cross-site scripting flaw triggered by specially crafted HTTP Referer headers, allowing an attacker to inject arbitrary script or HTML in users’ browsers. Affected products an...
CVE-2017-2136: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in WP Statistics version 12.0.4 and earlier allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...
PT-2017-15201
Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 12.0.5 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers. Recommendations For WP Statistics versions prior to...
NetIQ Access Manage Cross-Site Scripting Vulnerability
NetIQ Access Manager NAM is a resource access control solution from NetIQ, USA. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A cross-site scripting vulnerability exists in the /NAGErrors URI in NAM versions 4.2 and 4.3, whi...