X_CART Installation Script Cross Site Scripting Vulnerability

XCART is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qualiteam:x-cart";...

CVE-2015-6969

Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...

Cross site scripting

Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...

CVE-2015-6969

Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...

Sysax Multi Server 6.40 - SSH Component Denial of Service

''' Exploit title: Sysax Multi Server 6.40 ssh component denial of service vulnerability Date: 29-8-2015 Vendor homepage: http://www.sysax.com Software Link: http://www.sysax.com/download/sysaxservsetup.msi Version: 6.40 Author: 3unnym00n Details: ---------------------------------------------- by...

Windows User Name Detection via SNMP

Binary data 7179.pasl...

The vulnerability of the microprogramming software of the Cisco TelePresence VCS allows a intruder to gain access to the device.

The vulnerability of the control interface for microprogrammed software in Cisco TelePresence VCS devices is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the device using a specially crafte...

嘉缘人才系统sql注入

简要描述： rt 详细说明： 看到看到frcms\inc\ contacts.php if$companyid!=0 if$hireid!=0 $db -query"update $cfg'tbpre'hire set hvisitcount=hvisitcount+1 where hid=$hireid and hcomid=$companyid"; $goto=$cfg'path'."co/hire.php?id=$hireid"; $rs = $db-getone"select...

Mobile Vikings: Stored xss in user name (2) affected another user.

Again we have to users: A - attacker B - victim User A attacker has name - namealert1 and add auth to user B victim. User B receive a letter and get remider about new request on website. And open it https://mobilevikings.com/account/requests/ And probably press "Accept" and got xss fired. x:confi...

Mobile Vikings: Stored xss in user name

In prev report i showed xss in user name thru cookie, there is another place where this name shows and fired xss. After send auth request open https://mobilevikings.be/en/account/authorization/overview/ in account who send request and press "Remove authorization" and got another way to fire xss...

Mobile Vikings: Reflected xss in user name thru cookie

Imagine, that we have user A with name - namealert1 And user B User B request a sim card and the Add authorization to user A of course this is not the common way to exploit. As a result we have xss thru user name in flash message thru cookie. And ! we got properly singed cookie with xss payload...

CVE-2014-9019

Multiple cross-site request forgery CSRF vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin user name or 2 conduct cross-site scripting XSS attacks via the sysUserName parameter in a save action to...

DEBIAN-CVE-2014-3756

The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service hang and resource consumption via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the 1 user or 2 channel name in a Qt dialog, 3...

PT-2014-5440 · Cloudbees +1 · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 1.583 Jenkins LTS versions prior to 1.565.3 Description: The issue allows remote attackers to enumerate user names via vectors related to login attempts. Recommendations: For Jenkins versions prior to 1.583, update t...

CVE-2014-5176

SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors...

Hardcoded credentials

SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors...

PlatinumFTPServer 1.0.18 Multiple Malformed User Name Connection Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12790/info PlatinumFTPServer is prone to a denial-of-service vulnerability. This issue is reported to occur when a remote user makes 50 or more connections that attempt to authenticate with a malformed user name...

TransSoft Broker FTP Server 3.0 x/4.0 User Name Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/783/info If an unusually long user name is passed to the Broker FTP server software, the program will crash. If the program is running as a service, the service will consume all available memory and crash the entire syste...

SMF Mod Member Awards 1.0.2 - Blind SQL Injection Exploit

No description provided by source. ------------------------------------------------------------------------- SMF Component Member Awards Blind SQL-injection Vulnerability ------------------------------------------------------------------------- author: eLwaux thanks: mailbrush, antichat.ru,...

C.J. Steele Tattle Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13883/info tattle is affected by a remote command execution vulnerability. An attacker can supply arbitrary commands prefixed with the '|' character as a value for the 'tld' variable that will be executed in the context o...