CVE-2017-12321

The CVE-2017-12321 set concerns Cisco Registered Envelope Service, specifically its web interface. The reported flaws are cross-site scripting (XSS) vulnerabilities caused by insufficient validation of user-supplied input in the web-based management interface. An unauthenticated, remote attacker ...

CVE-2017-12321

Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service a cloud-based service could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are du...

Cisco Registered Envelope Service Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are due to insufficient...

Cross-Site Scripting (XSS)

genix/cms is susceptible to cross-site scripting XSS attacks. When a registered user replies to a post with an XSS payload and the administrator views this comment, the payload is executed...

Piwigo Plugin User Tag 0.9.0 - Cross-Site Scripting

Piwigo Plugin User Tag 0.9.0 - Cross-Site Scripting Exploit Title: Piwigo plugin User Tag , Persistent XSS Date: 10 Aug, 2017 Extension Version: 0.9.0 Software Link: http://piwigo.org/basics/downloads Extension link : http://piwigo.org/ext/extensionview.php?eid=441 Exploit Author: Touhid M.Shaikh...

CVE-2015-8009

The MWOAuthDataStore::lookuptoken function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the signature when checking the authorization signature, which allows remote registered Consumers to use another Consumer's...

File Upload Vulnerability for Registered Members of Poscms and finecms

POSCMS is an open source, cross-platform web content management system developed by Php+Mysql; FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. Poscms and finecms registered members of a file upload vulnerability , attackers can use the...

CVE-2015-6567

Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/filemanager/browse/ aka the filemanager does not validate the parameter "filename" properly. Exploitation requires a registered user who has access to upload functionality...

Unrestricted file upload

Wolf CMS before 0.8.3.1 allows unrestricted file rename and PHP Code Execution because admin/plugin/filemanager/browse/ aka the filemanager does not prevent a change of a file extension to ".php" after originally using the parameter "filename" for uploading a JPEG image. Exploitation requires a...

CVE-2017-3889

A vulnerability in the web interface of the Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to redirect a user to a undesired web page, aka an Open Redirect. This vulnerability affects the Cisco Registered Envelope cloud-based service. More Information: CSCvc6012...

CVE-2017-3889

A vulnerability in the web interface of the Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to redirect a user to a undesired web page, aka an Open Redirect. This vulnerability affects the Cisco Registered Envelope cloud-based service. More Information: CSCvc6012...

CVE-2017-3889

The CVE-2017-3889 entry describes an Open Redirect in the Cisco Registered Envelope Service web interface (cloud-based). The vulnerability stems from improper input validation in the HTTP request parameters, allowing an unauthenticated, remote attacker to redirect users to a malicious URL. Affect...

Cisco Registered Envelope Service Open Redirect Vulnerability

A vulnerability in the web interface of the Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to redirect a user to a undesired web page. The vulnerability is due to improper input validation of the parameters of the HTTP request. An attacker could exploit this...

WordPress Private Messages 1.0.1 SQL Injection

Exploit Title: WP Private Messages 1.0.1 a Plugin WordPress a Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/wp-private-messages/ Software Link: https://wordpress.org/plugins/wp-private-messages/ Contact: http://twitter.com/lenonleite Website:...

Wordpress WP Private Messages 1.0.1 Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WP Private Messages 1.0.1 – Plugin WordPress – Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/wp-private-messages/ Software Link: https://wordpress.org/plugins/wp-private-messages/...

WordPress Plugin Sirv 1.3.1 - SQL Injection

WordPress Plugin Sirv 1.3.1 - SQL Injection Exploit Title: Sirv 1.3.1 Plugin For WordPress Sql Injection Date: 10/11/2016 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/sirv/ Software Link: https://wordpress.org/plugins/sirv/ Contact: http://twitter.com/lenonleite...

Symantec IT Management Suite Denial of Service Vulnerability

Symantec IT Management Suite enables IT administrators to securely manage the entire lifecycle of desktops, laptops, and servers, including deployment, asset management, patching, and troubleshooting, in Windows, Mac, Linux, Unix, and virtual environments to dramatically reduce costs and increase...

UBUNTU-CVE-2016-4985

The ironic-api service in OpenStack Ironic before 4.2.5 Liberty and 5.x before 5.1.2 Mitaka allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the...

Parsijoo Cross Site Scripting

================================================================================ Cross Site Scripting on Search Engine Parsijoo ================================================================================ Author: bl4ckmohajem [email protected] home page : http://www.parsijoo.ir/...

Caught on the web of any user of the password reset vulnerability-vulnerability warning-the black bar safety net

Phone reset password password reset operation is not associated with a specific phone number, the lead can be reset to any phone registration account password. 1. The following url returns a result, you can traverse all the mobile phones registered account: http://api1.fun.tv/ajax/getmobilevcode/...