462 matches found
CVE-2018-15903
The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting XSS. An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies...
CVE-2017-4011: Improper Neutralization of Input During Web Page Generation
Embedding Script XSS in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention NDLP 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request...
PT-2016-7623
Name of the Vulnerable Software and Affected Versions Citrix NetScaler ADC versions prior to 10.1 135.8 Citrix NetScaler ADC versions prior to 10.5 61.11 Citrix NetScaler ADC versions prior to 11.0 65.31/65.35F Citrix NetScaler ADC versions prior to 11.1 47.14 Description The issue allows a remot...
Bumble: Password modification without knowing actual password & httpOnly bypass
Two issues: Session cookie is returned in HTML source code of /encounters page, which would allow an XSS attacker to steal it, even if httpOnly is activated. A secret value, present in HTML source code of some api.phtml pages, can be used to modify user's password without knowing actual one...
Claroline 1.11.8 Cross Site Scripting Vulnerability
Malicious users can inject JavaScript, HTML. and attacker can steal the session cookie and take over the account. Exploit Title: Claroline 1.11.8 Cross Site Scripting Date: 2013 11 October Author: Arsan Software Homepage: http://www.claroline.net Version : 1.11.8 Security Risk: High Tested on:...
PHPFox v3.4.1 XSS vulnerabilities
Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. An attacker can steal the session cookie and take over the account, impersonating the user. It is also possible to modify the content of the page...
phAlbum PHP Gallery Script Cross Site Scripting
Exploit Title: phAlbum php Gallery Script Reflected XSS Vulnerability Date: 2012 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr Issue: Reflected XSS Risk level: High Malicious users may inject JavaScript, VBScript, ActiveX, HTML or...
CMS Wizard Cross Site Scripting
================================================================= -=CMS wizard Cross Site Scripting ================================================================= Author: XaDaL Date: 14-02-2012 vendor: http://www.cmswizard.co.uk/ tested on: windows mobile dork : powered by CMS wizard This...
DPI 1.1-Final Cross Site Scripting
view source print? andresg888 Vendor : http://www.image-host-script.com/ Contact : andresg8884tgmaildotcom Web: : www.ilegalintrusion.net & www.bl4ck-p0rtal.org Dork : No DoRk f0R ScRipT KiDDieS Example1: http://server/path/images.php?date=%3Cscript%3Ealert123456%3C/script%3E Example2:...
2009 You! Hostit! XSS
No description provided by source. andresg888 Contact : andresg8884tgmaildotcom Web: : www.ilegalintrusion.nethttp://www.ilegalintrusion.net & www.bl4ck-p0rtal.orghttp://www.bl4ck-p0rtal.org Dork : No DoRk f0R ScRipT KiDDieS Example:...
DPI 1.1-final Powered by Clixint XSS
No description provided by source. andresg888 Vendor : http://www.image-host-script.com/ Contact : andresg8884tgmaildotcom Web: : www.ilegalintrusion.nethttp://www.ilegalintrusion.net & www.bl4ck-p0rtal.orghttp://www.bl4ck-p0rtal.org Dork : No DoRk f0R ScRipT KiDDieS Example1:...
PT-2009-12: UMI.CMS Cross-Site Scripting Vulnerability
UMI.CMS is a content management system CMS software, usually implemented as a Web application, for creating and managing HTML content. It is used to manage and control a large, dynamic collection of Web material HTML documents and their associated images. Vulnerability Description Positive...
IMP common-footer.inc Parent Frame Page Title XSS
According to its version, the remote installation of IMP fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...
Horde Nag common-footer.inc Parent Frame Page Title XSS
According to its version, the remote installation of Nag fails to fully sanitize user-supplied input when setting the parent frame's page title by JavaScript in 'templates/common-footer.inc'. By leveraging this flaw, an attacker may be able to inject arbitrary HTML and script code into a user's...
Magic Winmail Server 4.0 (Build 1112) - download.php Traversal Arbitrary File Access
Magic Winmail Server 4.0 Build 1112 - download.php Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/12388/info Magic Winmail Server is reportedly affected by multiple vulnerabilities. There are two distinct directory traversal vulnerabilities in the Webmail interface...
ubbXSS.txt
Vendor: Infopop URL: http://www.infopop.com/ tested Versions: 6.2.3 & 6.5 remote: yes vendor notified: 06 Dec 2004 at 01:08 AM Vendor response: 06/07 Dec 2004 01:33 AM/06:08 PM Update status: ..in process ============================================================ Summary: UBBThreads is a High e...
[Full-Disclosure] Multiple XSS Vulnerabilities in several UBB.Thread Versions
Vendor: Infopop URL: http://www.infopop.com/ tested Versions: 6.2.3 & 6.5 remote: yes vendor notified: 06 Dec 2004 at 01:08 AM Vendor response: 06/07 Dec 2004 01:33 AM/06:08 PM Update status: ..in process ============================================================ Summary: UBBThreads is a High e...
Debian DSA-436-1 : mailman - several vulnerabilities
Several vulnerabilities have been fixed in the mailman package : - CAN-2003-0038 - potential cross-site scripting via certain CGI parameters not known to be exploitable in this version - CAN-2003-0965 - cross-site scripting in the administrative interface - CAN-2003-0991 - certain malformed email...
kdelibs: Cross-domain cookie injection vulnerability
Background KDE is a widely-used desktop environment based on the Qt toolkit. kcookiejar in kdelibs is responsible for storing and managing HTTP cookies. Konqueror uses kcookiejar for storing and managing cookies. Description kcookiejar contains a vulnerability which may allow a malicious website ...
