PT-2017-16933

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance versions prior to 4.3.1.2 Description The issue concerns a remote command injection vulnerability in a section of the machine's interface responsible for generating reports. This vulnerability can be exploited via the toke...

CVE-2017-6184: Improper Neutralization of Special Elements used in a Command

In Sophos Web Appliance SWA before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter, aka NSWA-1303...

amigo-browser.ru XSS vulnerability

Vulnerable URL: http://amigo-browser.ru/dkit-hps/?chid=12930partnerid=dse.1:812270,dse.2:812274,hp.1:812269,hp.2:812273,pult.1:812271,pult.2:812275,any.2:812272,any:812268=fDrYpMqTUQ=818068=hdclub"alert/OPENBUGBOUNTY/...

CVE-2017-6099

Cross-site scripting XSS vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK aka merchant-sdk-php 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter...

CVE-2017-6099

Cross-site scripting XSS vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK aka merchant-sdk-php 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter...

CVE-2017-6099: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK aka merchant-sdk-php 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter...

CVE-2017-6099

Cross-site scripting XSS vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK aka merchant-sdk-php 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter...

PT-2017-16895

Name of the Vulnerable Software and Affected Versions PayPal PHP Merchant SDK aka merchant-sdk-php version 3.9.1 Description The issue concerns a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the token parameter in the...

Itech B2B Script SQL Injection Vulnerability (CNVD-2017-01850)

B2B Script v4.29 is a versatile WEB solution for those who want to quickly publish their B2B portals in minutes. A SQL injection vulnerability exists in the 'token' in the catcompany.php page in B2B Script v4.29, which can be exploited by an attacker to obtain sensitive information from the...

SQL Injection Vulnerability in the 'token[]' Parameter of Shangyi CMS

Shangyi CMS, or 31cms for short, is a drop-in microsoft public platform management system. A SQL injection vulnerability exists in Business Easy CMS. The lack of filtering of the 'token' parameter allows attackers to exploit the vulnerability to obtain sensitive information about the database...

PT-2016-5965

Name of the Vulnerable Software and Affected Versions Apache Archiva versions 1.3.9 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding new repository proxy connectors via the "admin/addProxyConnector...

Vimeo: All Vimeo Private videos disclosure via Authorization Bypass

Hello, There is a vulnerability in https://vimeo.com/VIDEOID?action=share that makes all Vimeo private videos available to anybody. POC link : http://opnsec.com/vimeo/vl/videoLeak.php?video=VIDEOID POC requirements : - No need to be logged in Vimeo - Because of sensitivity of this, I put a passwo...

Serendipity SQL Injection Vulnerability (CNVD-2015-06035)

Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. An SQL injection vulnerability exists in the 'serendipitycheckCommentToken' function in the include/functionscomments.inc.php script in...

freeshell fix side-channel attack vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability science Side-channel attacksside channel attack referred to as SCA, also known as side-channel attacks:for the encryption of electronic devices during the run time consumption, power consumption or electromagnetic radiation or the like of the side-channel information leakage and...

Code injection

The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter...

CVE-2014-4980

The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter...

CVE-2014-4980

The CVE-2014-4980 entry affects Tenable Nessus/Web UI, specifically Nessus versions 5.2.3–5.2.7. The issue is an information-disclosure vulnerability in the Web UI: the /server/properties endpoint can disclose sensitive data via the token parameter due to insufficient parameter checking. Reported...

PT-2014-6242

Name of the Vulnerable Software and Affected Versions Tenable Web UI versions 5.2.3 through 5.2.7 Description The issue allows remote attackers to obtain sensitive information. This is achieved through the "/server/properties" resource, specifically by exploiting the token parameter...

CVE-2014-4980: Exposure of Sensitive Information to an Unauthorized Actor

The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter...

CVE-2013-0201

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 QUERYSTRING to core/lostpassword/templates/resetpassword.php, 2 mime parameter to apps/files/ajax/mimeicon.php, or 3 token parameter to...