155 matches found
CVE-2017-6026
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization an...
CVE-2016-9169
A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enable a remote attacker to execute JavaScript in the context of a valid user's browser session by getting the user to click on a specially...
CVE-2016-9169
A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enable a remote attacker to execute JavaScript in the context of a valid user's browser session by getting the user to click on a specially...
CVE-2016-9169
The vulnerability CVE-2016-9169 affects the web console of the Document Viewer Agent in Novell GroupWise (older than 2014 R2 Support Pack 1 Hot Patch 2). It is a reflected XSS where a remote attacker can entice a user to click a crafted link, enabling JavaScript execution in the user’s browser se...
CVE-2016-6625
An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to...
Legal Robot: The websocket traffic is not secure enough
'Cross-Site WebSocket Hijacking' is possible, because the websocket connection is not secure enough. The traffic from and to the websocket can be sniffed with Chrome see attachment, and replayed elsewhere cross-domain. Explanation:...
Investors Application - Client Side Cross Site Vulnerability
Document Title: =============== Investors Application - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1540 Facebook Security ID: 246414938 Release Date: ============= 2016-02-12 Vulnerability Laboratory ID VL-ID:...
Lithium Forum - Client Side POST Inject Vulnerability
Document Title: =============== Lithium Forum - Client Side POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1519 Release Date: ============= 2015-12-22 Vulnerability Laboratory ID VL-ID: ==================================== 1519...
AirDroid ID - Client Side JSONP Callback Vulnerability
Document Title: =============== AirDroid ID - Client Side JSONP Callback Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1544 Release Date: ============= 2015-07-10 Vulnerability Laboratory ID VL-ID: ==================================== 154...
Grindr 2.2.1 Insufficient Validation
Document Title: =============== Grindr v2.1.1 iOS - eMail Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1426 Release Date: ============= 2015-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 1426 Commo...
InVision: CSRF Token in cookies!
Your web application generates XSRF token values inside cookies which is not a best practice for web applications as revelation of cookies can reveal XSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only. More...
Joomla! 1.6.3 and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities
Joomla! 1.6.3 and lower | Multiple Cross Site Scripting XSS Vulnerabilities 1. OVERVIEW Joomla! 1.6.3 and lower are vulnerable to multiple Cross Site Scripting issues. 2. BACKGROUND Joomla is a free and open source content management system CMS for publishing content on the World Wide Web and...
Yahoo Mail - Cross Site Scripting & Webfilter Bypass
Document Title: =============== Yahoo Mail - Cross Site Scripting & Webfilter Bypass Release Date: ============= 2011-06-29 Vulnerability Laboratory ID VL-ID: ==================================== 130 Product & Service Introduction: =============================== Enjoy tons of features and fun wa...
phpMyAdmin 3.3.5 / 2.11.10 <= Cross Site Scripting (XSS) Vulnerability
============================================================================== phpMyAdmin 3.3.5 / 2.11.10 = Cross Site Scripting XSS Vulnerability ============================================================================== 1. OVERVIEW The phpMyAdmin web application was vulnerable to Cross Site...