24 matches found
pwn-pulse
pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability CVE-2019-11510 Script authored by braindead @BishopFox. Based on research by Orange Tsai and Meh Chang. Thanks also to Alyssa Herrera and 0xDezzy for additional insights. Huge thanks to bl4ckh0l3z for fixing,...
EUVD-2020-29884
Malware in sbrugna...
EUVD-2001-0840
Malware in sbrugna...
EUVD-2019-0420
Malware in sbrugna...
EUVD-2018-3017
Malware in sbrugna...
EUVD-2025-13360
Malicious code in bioql PyPI...
CVE-2023-36288
An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter...
Glovo: Moodle XSS on evolve.glovoapp.com
Cross Site Scripting XSS / Moodle XSS Summary : Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...
CVE-2020-9055
Versiant LYNX Customer Service Portal CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or...
CVE-2020-9055
Versiant LYNX CSP 3.5.2 is vulnerable to stored cross-site scripting due to insufficient input validation, enabling a local, authenticated attacker to inject JavaScript that is stored and executed for end users (possible redirects, session cookie hijacking, information disclosure). The issue is d...
PT-2020-20463
Name of the Vulnerable Software and Affected Versions Versiant LYNX Customer Service Portal CSP version 3.5.2 Description The issue allows a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user, potentially leading to website redirects, session...
CVE-2020-9055: Improper Neutralization of Input During Web Page Generation
Versiant LYNX Customer Service Portal CSP, version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or...
PT-2019-13027
Name of the Vulnerable Software and Affected Versions MailEnable Enterprise Premium version 10.23 Description The issue allows for stored and reflected cross-site scripting XSS attacks. It is also possible to hijack the session cookie due to the lack of the HttpOnly flag, which can be exploited t...
CVE-2018-5411: Improper Neutralization of Input During Web Page Generation
Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into...
PT-2018-16947
Name of the Vulnerable Software and Affected Versions Pixar's Tractor software versions 2.2 and earlier Description The issue concerns a stored cross-site scripting problem in a field where users can add notes to existing nodes. This allows an attacker to insert Javascript code into the note fiel...
WordPress W3 Total Cache 0.9.4.1 Race Condition
------------------------------------------------------------------------ Information disclosure race condition in W3 Total Cache WordPress Plugin ------------------------------------------------------------------------ Sipke Mellema, July 2016...
CTERA 3.2.29.0 and 3.2.42.0 - Stored XSS
No description provided by source. 恶意用户可以修改项目文件夹描述进行XSS攻击和HTML注入（添加链接、图片和按钮等）。 因为项目文件夹时被不同用户共享，该漏洞可以用来抓取会话cookie。 创建一个项目文件夹并添加下面的描述（根据版本修改特定路径）：...
Design/Logic Flaw
IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test account by capturing these cookies...
PT-2013-2395
Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions 5.6 and 8.x through 8.6 Description The issue allows man-in-the-middle attackers to hijack the test account by capturing session cookies sent to a specific external server. Recommendations For IBM...