UBUNTU-CVE-2016-5739

The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy CSP protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication toke...

openSUSE Security Update : phpMyAdmin (openSUSE-2016-806)

This phpMyAdmin update to version 4.4.15.7 fixes the following issues : Issues fixed: Setup script doesn't use input type 'password' in all relevant locations Security issues fixed : - PMASA-2016-17 CVE-2016-5701, CWE-661 https://www.phpmyadmin.net/security/PMASA-2016-17/ - BBCode injection...

Referrer leak in transformations

PMASA-2016-28 Announcement-ID: PMASA-2016-28 Date: 2016-06-23 Summary Referrer leak in transformations Description A vulnerability was reported where a specially crafted Transformation could be used to leak information including the authentication token. This could be used to direct a CSRF attack...

ownCloud: doc.owncloud.org: XSS via Referrer

Hi, The Referer Header in the following request, can be used to trigger an XSS. GET /promote/ HTTP/1.1 Host: doc.owncloud.org User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:45.0 Gecko/20100101 Firefox/45.0 Referer: javascript:alert'XSS'; Accept:...

FreeBSD : moodle -- multiple vulnerabilities (a430e15d-f93f-11e5-92ce-002590263bf5)

Marina Glancy reports : - MSA-16-0003: Incorrect capability check when displaying users emails in Participants list - MSA-16-0004: XSS from profile fields from external db - MSA-16-0005: Reflected XSS in moddata advanced search - MSA-16-0006: Hidden courses are shown to students in Event Monitor ...

moodle -- multiple vulnerabilities

Marina Glancy reports: MSA-16-0003: Incorrect capability check when displaying users emails in Participants list MSA-16-0004: XSS from profile fields from external db MSA-16-0005: Reflected XSS in moddata advanced search MSA-16-0006: Hidden courses are shown to students in Event Monitor...

Open redirect

Multiple open redirect vulnerabilities in the Aurora starter store in IBM WebSphere Commerce 7.0 through Feature Pack 8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referrer parameter...

discover-rutland.co.uk vulnerability

Vulnerable URL: http://www.discover-rutland.co.uk/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 1959404 Google Pagerank| 3 VIP website status:| No Check...

visittunbridgewells.com vulnerability

Vulnerable URL: http://www.visittunbridgewells.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 1410456 Google Pagerank| 2 VIP website status:| No Check...

visitsouthport.com vulnerability

Vulnerable URL: http://www.visitsouthport.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 702539 Google Pagerank| 5 VIP website status:| No Check...

padstowlive.com vulnerability

Vulnerable URL: http://www.padstowlive.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 2714434 Google Pagerank| 4 VIP website status:| No Check...

visitchester.com vulnerability

Vulnerable URL: http://www.visitchester.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 20.12.2015 Latest check for patch:| 20.12.2015 11:33 GMT Vulnerability status:| Publicly disclosed Alexa Rank| 753682 Google Pagerank| 5 VIP website...

greatcountrypubs.com vulnerability

Vulnerable URL: http://www.greatcountrypubs.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 20.12.2015 Latest check for patch:| 20.12.2015 11:33 GMT Vulnerability status:| Publicly disclosed Alexa Rank| 1278832 Google Pagerank| 4 VIP...

visitmaidstone.com vulnerability

Vulnerable URL: http://www.visitmaidstone.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 2505725 Google Pagerank| 3 VIP website status:| No Check...

visit-hampshire.co.uk vulnerability

Vulnerable URL: http://www.visit-hampshire.co.uk/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 465169 Google Pagerank| 4 VIP website status:| No Check...

visit1066country.com vulnerability

Vulnerable URL: http://www.visit1066country.com/engine/referrer.asp?web=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability status:| Publicly disclosed Alexa Rank| 1053687 Google Pagerank| 4 VIP website status:| No Check...

On (OAuth) token hijacks for fun and profit part #2 (Microsoft/xxx integration)

In a previous blogpost we have already analyzed a token hijack on one OAuth integration between some Microsoft and Google service and seen what went wrong. Now it is time to see yet another integration between Microsoft and xxxx unluckily I can't disclose the name of the other company due the fac...

Web Reference Database Open Redirect Vulnerability

Web Reference Database is a web-based multi-user interface product that provides search tools and automatic indexing for managing scientific literature. An open redirection vulnerability exists in the handling of the 'referrer' parameter of the Web Reference Database, which allows an attacker to...

vBSEO 3.6.0 functions_vbseo_hook.php Referer RCE

Remote command execution vulnerability in vBSEO functionsvbseohook.php Referer Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

ownCloud: apps.owncloud.com: XSS via referrer

Look at next request: Host: apps.owncloud.com User-Agent: Mozilla/5.0 Windows NT 6.3; WOW64; rv:40.0 Gecko/20100101 Firefox/40.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer:...