Unspecified Cross-Site Scripting Vulnerability in PHPWind

PHPWind is a set of PHP-based Web forum program . PHPWind suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when malicious...

WordPress Citizen Space Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Citizen Space plugin, which allows remote attackers to exploit the vulnerability to inject malicious...

Avsarsoft Matbaa Script Cross-Site Scripting Vulnerability

Avsarsoft Matbaa Script is a WEB-based script. Avsarsoft Matbaa Script suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...

Huawei SEQ Analyst suffers from multiple cross-site scripting vulnerabilities

Huawei SEQ Analyst is a solution with proven big data storage and analysis capabilities. Huawei SEQ Analyst fails to properly filter multiple parameters, which can be exploited by a remote attacker to construct malicious URIs and trick users into parsing them, which can obtain sensitive cookies,...

Chamilo LMS 1.9.10 Cross Site Request Forgery / Cross Site Scripting

I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control over valid user accounts in LMS, perform...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2015-01676)

Microsoft SharePoint Server is an integrated suite of server capabilities that provides comprehensive content management and enterprise search, accelerates shared business processes, and facilitates information sharing across boundaries. Microsoft SharePoint Server fails to properly process...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2015-01273)

IBM WebSphere Portal provides a framework for combining application or business mashups and provides a high-level tool to construct flexible, SOA-based solutions. A cross-site scripting vulnerability exists in IBM WebSphere Portal, which allows remote attackers to exploit the vulnerability to...

Coinbase: open authentication bug

Hi, If developer registers one of the three url's with out http protocol ex:example.com in oauth registration then he would be redirected to www.coinbase.comexample.com.This makes the user to redirect to another site than the real application.Attacker could take advantage of this and steal the...

BullGuard (Multiple Products) - Arbitrary Write Privilege Escalation

BullGuard Multiple Products - Arbitrary Write Privilege Escalation / Exploit Title - BullGuard Multiple Products Arbitrary Write Privilege Escalation Date - 04th February 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.bullguard.com/ Tested Version - 14.1.285.4 Driver...

Trend Micro Multiple Products 8.0.1133 - Privilege Escalation Exploit

Exploit for windows platform in category local exploits / Exploit Title - Trend Micro Multiple Products Arbitrary Write Privilege Escalation Date - 31st January 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - http://www.trendmicro.co.uk/ Tested Version - 8.0.1133 Driver Version -...

USN-2458-1: Firefox vulnerabilities

Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to caus...

Hacking Facebook Accounts Using Android 'Same Origin Policy' Vulnerability

A serious security vulnerability has been discovered in the default web browser of the Android OS lower than 4.4 running on a large number of Android devices that allows an attacker to bypass the Same Origin Policy SOP. The Android Same Origin Policy SOP vulnerability CVE-2014-6041 was first...

F5 Networks BIG-IP : cURL vulnerability (SOL15875)

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. CVE-2013-1944 C Tenable Network Security, Inc. The descriptive text and...

Portable router storage 0 DAY vulnerability that hackers can steal the privacy-vulnerability warning-the black bar safety net

Tenda router 4G301 model the presence of memory-typeXSScross-site scripting vulnerability vulnerability number: RSV-2 0 1 4-0 0 1 River. Rising security experts, the vulnerability is currently no official patch, belonging to the 0 DAY vulnerability, an attacker can carefully construct a malicious...

Invision Power Board (IP.Board) 3.x - Cross-Site Request Forgery Token Hjiacking

Invision Power Board IP.Board 3.x - Cross-Site Request Forgery Token Hjiacking Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous...

RaidenTunes - music_out.php Cross-Site Scripting

RaidenTunes - musicout.php Cross-Site Scripting source: https://www.securityfocus.com/bid/42167/info RaidenTunes is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...

Flash "Rosetta" JSONP GET/POST Response Disclosure Exploit

A website that serves a JSONP endpoint that accepts a custom alphanumeric callback of 1200 chars can be abused to serve an encoded swf payload that steals the contents of a same-domain URL. Flash 'Flash "Rosetta" JSONP GET/POST Response Disclosure', 'Description' = %q A website that serves a JSON...

Glassfish Enterprise Server 2.1 Admin Console /customMBeans/customMBeans.jsf URI XSS

No description provided by source. source: http://www.securityfocus.com/bid/34824/info GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. Attacker-supplied HTML and script code would run in the conte...

Zikula CMS 1.3.5 - Multiple Vulnerabilities

No description provided by source. Document Title: =============== Zikula CMS v1.3.5 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1114 Release Date: ============= 2013-10-16 Vulnerability Laboratory ID VL-ID:...

ImageVue 1.7 - dir2.php path Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/28138/info Imagevue is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...