Server: Multiple stored XSS in "contacts" application

Due to not sanitising all user provided input, the "contacts" application shipped with the mentioned ownCloud versions is vulnerable to multiple stored cross-site scripting attacks. The "contacts" application is enabled by default in the ownCloud Community Edition but not shipped with the ownClou...

Multiple ADSL Routers Directory Traversal Vulnerability (Mar 2015) - Active Check

Multiple ADSL routers are prone to a directory traversal vulnerability because they fail to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting

Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting Exploit Title: Persistent XSS via Markdown on Telescope = 0.9.2 Date: Aug 22 2014 Exploit Author: shubs Vendor Homepage: http://www.telescopeapp.org/ Software Link: https://github.com/TelescopeJS/Telescope Version: = 0.9.2 CVE :...

Cisco WebEx Meetings Server Administrative Portal Cross-Site Scripting Vulnerability

A vulnerability in the administration portal page of the Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS attacks. The vulnerability is due to insufficient validation of user-supplied input submitted to the administration portal page ...

Fortinet FortiMail Web Action Quarantine Release Feature XSS Vulnerability (FG-IR-15-005) - Active Check

Fortinet FortiMail is prone to a XSS vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier...

Microsoft Exchange Server Privilege Escalation Vulnerability (3040856)

This host is missing an important security update according to Microsoft Bulletin MS15-026. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Microsoft SharePoint Server WAS Multiple Vulnerabilities (3038999)

This host is missing an important security update according to Microsoft Bulletin MS15-022. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Microsoft SharePoint CVE-2015-1636 Cross Site Scripting Vulnerability

Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

Microsoft SharePoint CVE-2015-1633 Cross Site Scripting Vulnerability

Description Microsoft SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may...

ThinkPHP一处过滤不当造成SQL注入漏洞

简要描述： 内核中某个模块开发的太粗糙啦。 详细说明： 问题出现在session，Thinkphp支持更换session handle。 handle中包括Db和Memcache，如下配置即可使用数据库作为session的存储器： 设置了选项后，在数据库里插入这个表（前缀think可以自己定义）： / 数据库方式Session驱动 CREATE TABLE thinksession sessionid varchar255 NOT NULL, sessionexpire int11 NOT NULL, sessiondata blob, UNIQUE KEY sessionid...

WordPress Divi Theme Directory Traversal Vulnerability

WordPress Divi Theme is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

F5 Networks BIG-IP : ASM < 11.6.0 Response Body XSS

The F5 Networks Application Security Manager ASM running on the remote device is prior to version 11.6.0. It is, therefore, affected by a cross-site scripting vulnerability due to improper validation of user-supplied input to the 'Response Body' field when a new user account is being created. A...

PHP object injection attack vulnerability in Slim.

https://github.com/slimphp/Slim/blob/master/Slim/Middleware/SessionCookie.phpL127 Generally, it's a bad idea to blindly unserialize user-controllable input. https://www.owasp.org/index.php/PHPObjectInjection EDIT - for people who don't want to read the whole thread: The SessionCookie class is not...

Cisco AsyncOS Software HTTP Redirect Vulnerability

A vulnerability in the web framework of Cisco AsyncOS could allow an unauthenticated, remote attacker to inject a crafted HTTP header that could cause a web page redirection to a malicious website. The vulnerability is due to insufficient validation of user input before it is used as an HTTP head...

Magento Multiple HTML Injection Vulnerabilities

Magento is prone to multiple HTML injection vulnerabilities because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Live off the mobile phone client xss comfortably into the background-bug warning-the black bar safety net

Brief description: Live off the mobile phone client sidexsscomfortably, you can log in the background Detailed description: 0x00 keywords code area Live off to find room Android App, user feedback, comfortably, the storage-typexss, the'" 0x02 process User feedback directly inserted into the !...

MantisBT 1.2.13 < 1.2.18 XSS

Binary data 8906.prm...

Piwigo 2.7.3 Cross Site Scripting / SQL Injection Vulnerabilities

CMS Piwigo versions 2.7.3 and below suffer from cross site scripting and remote SQL injection vulnerabilities. Reflecting XSS- and SQL Injection vulnerability in CMS Piwigo = v. 2.7.3 Author: Steffen Rösemann Affected Software: CMS Piwigo = v. 2.7.3 Release date: 9th January 2015 Vendor URL:...

Zoho ManageEngine OpManager 'OPM_BVNAME' Multiple Vulnerabilities

The remote host is running a version of Zoho ManageEngine OpManager that is affected by multiple vulnerabilities : - A blind SQL injection vulnerability exists due to improper sanitization of user-supplied input to the 'OPMBVNAME' parameter of the APMBVHandler servlet. An unauthenticated, remote...

Vulnerability analysis: a Markdown parser's persistent XSS Vulnerability, CVE-2 0 1 4-5 1 4 4-a vulnerability warning-the black bar safety net

What is the Markdown? a Markdown is a lightweight markup language, the popularity has got GitHub and Stack Overflow broad support, as ordinary people we can also easily get started. Use markdown to write articles very much like those trivial HTML tag can be behind without the tube. The last 5...