14355 matches found
Cisco Finesse Reflected Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of...
Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...
Cross-site Scripting (XSS)
Bolt CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input, allowing a malicious user to inject and execute arbitrary javascript through the Title Field of a new entry...
Legal Robot: SSL BREACH attack (CVE-2013-3587)
Hello security team, The site legalrobot.com is potentially vulnerable to the BREACH attack. Allowing an attacker the ability to: - Inject partial chosen plaintext into a victim's requests - Measure the size of encrypted traffic - can leverage information leaked by compression to recover targeted...
Cross-site Scripting (XSS)
TYPO3 CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly encode user input, allowing a malicious user to inject and execute arbitrary webscript when storing JSON data...
Cross-site Scripting (XSS)
Piwik is susceptible to cross-site scripting XSS attacks. The attacks exist because it does not sanitize the user-supplied input...
XSS vulnerability in code example
SECURITY Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The codegenerator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There...
Cross-site Scripting (XSS)
Moodle is vulnerable to cross-site scripting XSS attacks. The library does not properly filter user input in the qualification and rating fields for rubric/advanced grading. This allows a malicious user to inject and execute arbitrary script...
Cross-site Scripting (XSS)
concrete5 is vulnerable to cross-site scripting XSS attacks. The library fails to sanitize user input to bulkupdate.php and sitemapdragrequest.php, allowing a malicious user to inject and execute arbitrary script...
Cross-site Scripting (XSS)
Moodle is vulnerable to cross-site scripting XSS attacks. The library does not properly filter user input to the quizquestiontostring function in mod/quiz/editlib.php, allowing a malicious user to inject and execute arbitrary HTML script...
SQL Injection
Subrion is vulnerable to SQL Injection attacks. The library does not have any checking for user input through the $GET parameter in /front/search.php, allowing a malicious user to inject and execute arbitrary SQL...
Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...
CVE-2016-6798
In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on...
Sql injection
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...
CVE-2017-11414
Fiyo CMS 2.0.7 has SQL injection in dapur/apps/appcomment/syscomment.php via $POST'comment', $POST'name', $POST'web', $POST'email', $POST'status', $POST'id', and $REQUEST'id'...
Sophos Web Appliance 4.3.0.2 Remote Command Injection
Exploit Title: Sophos Web Appliance reporting JSON trafficType Remote Command Injection Vulnerablity Date: 01/28/2017 Exploit Author: xort @ Critical Start Vendor Homepage: www.sophos.com Software Link: sophos.com/en-us/products/secure-web-gateway.aspx Version: 4.3.0.2 Tested on: 4.3.0.2 CVE :...
Juniper ScreenOS 6.3.x < 6.3.0r24 Multiple XSS (JSA10782)
The version of Juniper ScreenOS running on the remote host is 6.3.x prior to 6.3.0r24. It is, therefore, affected by multiple cross-site scripting XSS vulnerabilities in the web user interface due to improper validation of user-supplied input before returning it to users. An authenticated, remote...
CVE-2017-9338
Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...
Cross site scripting
Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...