Advanced Discovery of Privileged Accounts: ACLight

ACLight is a tool for discovering privileged accounts through advanced ACLs Access Lists analysis. It includes the discovery of Shadow Admins in the scanned network. The tool queries the Active Directory AD for its objects’ ACLs and then filters and analyzes the sensitive permissions of each one...

SAP NetWeaver Portal Cross-Site Scripting Vulnerability

SAP NetWeaver is a service-oriented, integrated application platform from SAP that provides a development and runtime environment for SAP applications.SAP NetWeaver Portal is a portal solution that provides single sign-on information for authentication via a Web browser. A cross-site scripting...

frequence-sud.fr XSS vulnerability

Vulnerable URL: https://www.frequence-sud.fr/recherche/resultat.php?recherche="'/alert/openbugbounty/...

vakansia.net XSS vulnerability

Vulnerable URL: https://vakansia.net/vacancy/search-result/?type=2keywords=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Information Disclosure

ansible is vulnerable to information disclosure. It is possible because .result attribute of an ansible.executor.taskresult.TaskResult is being sent to the callback plugins without obscuring stdout information when using a nolog directive...

MailStore Server search-result Reflected Cross-Site Scripting

A reflected cross-site scripting vulnerability has been reported in MailStore Server. The vulnerability is due to insufficient input validation on user input for search results. A remote user can exploit this vulnerability by enticing an authenticated user to click on a malicious link...

LibreSSL TLS Certificate Validation Vulnerability

LibreSSL is an open source implementation of the Secure Sockets Layer SSL and Transport Layer Security TLS protocols. A certificate validation vulnerability exists in LibreSSL TLS. A remote attacker can exploit this vulnerability by relying on SSLgetverifyresult, resulting in LibreSSL lacking TLS...

Microsoft Internet Explorer Enhanced Protected Mode Sandbox Escape Vulnerability

This vulnerability allows remote attackers to escape the Enhanced Protected Mode EPM sandbox on vulnerable installations of Microsoft Internet Explorer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specif...

Mozilla: Use-after-free in nsAutoPtr during XSLT processing (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1, Firefox ESR 45.9, Firefox ESR 52.1, and Firefox 53...

baumit.at XSS vulnerability

Vulnerable URL: http://www.baumit.at/suchergebnisse.html?searchterm=%22%3Eblub%3Csvg%2Fonload%3Dalert%28%2FOPENBUGBOUNTY%2F%29%3E= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

caerphilly.gov.uk XSS vulnerability

Vulnerable URL: http://www.caerphilly.gov.uk/Search-Result?searchtext="'--!confirmOPENBUGBOUNTY...

Cross site scripting

An XSS vulnerability in the MantisBT Source Integration Plugin before 2.0.2 search result page allows an attacker to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by crafting any valid parameter...

CVE-2017-6958

An XSS vulnerability in the MantisBT Source Integration Plugin before 2.0.2 search result page allows an attacker to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by crafting any valid parameter...

CVE-2017-6958

An XSS vulnerability in the MantisBT Source Integration Plugin before 2.0.2 search result page allows an attacker to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by crafting any valid parameter...

CVE-2017-6958: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability in the MantisBT Source Integration Plugin before 2.0.2 search result page allows an attacker to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by crafting any valid parameter...

PT-2017-17425

Name of the Vulnerable Software and Affected Versions MantisBT Source Integration Plugin versions prior to 2.0.2 Description The issue allows an attacker to inject arbitrary HTML or JavaScript by crafting any valid parameter in the search result page, provided MantisBT's CSP settings permit it...

Mozilla: Memory Corruption when handling ErrorResult (MFSA 2017-06)

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox 52, Firefox ESR 45.8, Thunderbird 52, and Thunderbird 45.8...

discountflights.jp XSS vulnerability

Vulnerable URL: http://www.discountflights.jp/dynamic-flight-result.php?air-radio=on=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%27OPENBUGBOUNTY%27%29%3B%3E==%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%27OPENBUGBOUNTY%27%29%3B%3E==15%2F03%2F17=22%2F03%2F17=1=0+=0=Economylanguage=ja-JPcurrency=JPY=2...

om.discountflights.com XSS vulnerability

Vulnerable URL: http://www.om.discountflights.com/dynamic-flight-result.php?air-radio=on=%27%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22==%27%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22==03%2F12%2F17=03%2F12%2F17=1=0=0=Economylanguage=en-UScurrency=USD=2 Details:...

co.discountflights.com XSS vulnerability

Vulnerable URL: http://www.co.discountflights.com/dynamic-flight-result.php?air-radio=on=%27%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22==%27%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%22==03%2F12%2F17=03%2F12%2F17=1=0=0=Economylanguage=en-UScurrency=USD=2 Details:...