706 matches found
Totemomail Encryption Gateway 6.0.0_Build_371 JSONP Hijacking
COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: totemomail Encryption Gateway Vendor: totemo AG CSNC ID: CSNC-2018-002 CVE ID: CVE-2018-6562 Subject: JSONP hijacking Risk: High Effect: Remotely exploitable Author: Nicolas Heiniger Date: 14.05.2018...
CVE-2018-5705
Reservo Image Hosting 1.6 is vulnerable to cross-site scripting in the search engine (t parameter of /search). The vulnerability allows code execution via a malicious URL and can lead to session theft of users and admins due to an active login interface. PoC/exploit details are available in publi...
BizLogic xnami Cross-Site Scripting Vulnerability
BizLogic xnami is a set of PHP-based image sharing scripts online by the BizLogic team. A cross-site scripting vulnerability exists in BizLogic xnami version 1.0. A remote attacker can exploit this vulnerability to steal user and administrator sessions...
FoxSash ImgHosting Search Engine Cross-Site Scripting Vulnerability
FoxSash ImgHosting is a set of scripts for online image hosting. search engine is one of the search engines. A cross-site scripting vulnerability exists in the search engine in FoxSash ImgHosting version 1.5. A remote attacker can exploit this vulnerability by sending the 'search' parameter to th...
Design/Logic Flaw
FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...
CVE-2018-5479
FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...
ImgHosting 1.5 - Cross-Site Scripting
ImgHosting 1.5 - Cross-Site Scripting Exploit Title: ImgHosting Image Storage System 1.5 - Cross-Site-Scripting Date: 12-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: foxsash.com Version: 1.5 CVE-ID: CVE-2018-5479 ImgHosting – Image Storag...
Xnami 1.0 - Cross-Site Scripting
Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...
Design/Logic Flaw
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protection...
CVE-2017-15911
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protection...
IceWarp Server webmail component cross-site scripting vulnerability
IceWarp Server is a mail server product from IceWarp USA. The product supports email archiving, SmartAttach attachments, automatic migration, etc. webmail component is one of the mailbox components. A cross-site scripting vulnerability exists in the 'language' parameter of the webmail component i...
Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2017-04607)
Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in the affiliate-preview.php file in www/admin in versions prior t...
CVE-2017-6549
Session hijack vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before...
Investors Application Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability exists in Shareholder Investor Relations. A remote attacker can manipulate client requests to obtain a user's session...
TrendMicro SSO Redirect / Session Theft
Document Title: =============== Trend Micro SSO - Backend SSO Redirect & Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1694 Trand Micro ID: 1-1-1035080936 Release Date: ============= 2016-03-31 Vulnerability Laboratory ID VL-ID:...
Apache Solr < 4.10.5 'plugin.js' XSS
Binary data 8974.prm...
Monsta FTP 1.6.2 - Multiple Vulnerabilities
Monsta FTP version 1.6.2 suffers from cross site request forgery and cross site scripting vulnerabilities. Exploit Title: CSRF XSS Monsta FTP Google Dork: intitle: Monsta FTP CSRF / XSS Date: 2015-09-11 Exploit Author: hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: www.monstaftp.com...
IBM Leads Cross-Site Request Forgery Vulnerability (CNVD-2015-04109)
IBM Leads is a solution from IBM USA for improving the customer management process. The program provides functions such as finding prospects, assigning customers and sending notifications of new customer information. A cross-site request forgery vulnerability exists in IBM Leads. A remote attacke...
SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower
SEC Consult Vulnerability Lab Security Advisory 20150113-1 ======================================================================= title: Privilege Escalation & XSS & Missing Authentication product: Ansible Tower vulnerable version: =2.0.2 fixed version: =2.0.5 impact: high homepage:...
SAP BusinessObjects Explorer 14.0.5 Cross Site Flashing
COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html Product: BusinessObjects Explorer Vendor: SAP AG Subject: Cross Site Flashing Risk: High Effect: Remotely exploitable Author: Stefan Horlacher Date: 2014-10-10 SAP Security Note: 1908647 0 Abstract: -------------...