Trape Cross-Site Scripting Vulnerability

Trape is a set of open source Internet tracking and identification tools. It is capable of remotely identifying sessions and simulating phishing attacks. A cross-site scripting vulnerability exists in versions of Trape prior to 2017-11-05. A remote attacker can exploit the vulnerability to inject...

CVE-2017-17714

Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon...

CVE-2017-17713

Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the...

Sql injection

Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the...

Design/Logic Flaw

Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon...

CVE-2017-17714

Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon...

CVE-2017-17713

Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the...

CVE-2017-17713

Summary: CVE-2017-17713 and CVE-2017-17714 pertain to Trape, an open-source internet tracking/identification tool, with concrete issues reported in connected documents. For CVE-2017-17713, Trape prior to 2017-11-05 is vulnerable to SQL injection via multiple parameters and headers, including /nr ...

CVE-2017-17714

Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon...

CVE-2017-17713

Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the...

CVE-2017-17714

CVE-2017-17714 affects Trape prior to 2017-11-05, where an XSS vulnerability exists via multiple input vectors. The issue arises from unsanitized user-controlled input across a long list of parameters and headers, including /nr red, /nr vId, /register (country, countryCode, cpu, isp, lat, lon, or...