CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

Design/Logic Flaw

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

CVE-2017-10676

On D-Link DIR-600M devices before C1v3.05ENB01beta20170306, XSS was found in the form2userconfig.cgi username parameter...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. The attacks exist because lib/classes/event/userloginfailed.php does not escape the user-supplied username before returning it to the description during invalid login-attempt. This allows a malicious user to inject and execute arbitrary co...

CVE-2017-11180

FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in 1 the User-Agent header of an HTTP request or 2 the username entered on the login screen...

Cross site scripting

FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in 1 the User-Agent header of an HTTP request or 2 the username entered on the login screen...

CVE-2017-11180

FineCMS through 2017-07-11 has stored XSS in the logging functionality, as demonstrated by an XSS payload in 1 the User-Agent header of an HTTP request or 2 the username entered on the login screen...

Systemd Local Elevation of Privilege Vulnerability

systemd is a Linux-based system and service manager developed by German software developer Lennart Poettering and others. It is compatible with the SysV and LSB startup scripts and provides a framework for representing dependencies between system services. A security vulnerability exists in syste...

WMI Event Subscription Persistence Exploit

This Metasploit module will create a permanent WMI event subscription to achieve file-less persistence using one of five methods. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell'...

CVE-2017-1000082

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit e.g. "0day", running the service in question with root privileges rather than the user intended...

Design/Logic Flaw

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit e.g. "0day", running the service in question with root privileges rather than the user intended...

CVE-2017-1000082

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit e.g. "0day", running the service in question with root privileges rather than the user intended...

CVE-2017-1000082

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit e.g. "0day", running the service in question with root privileges rather than the user intended...

CVE-2017-1000082

Technical details about CVE-2017-1000082 are not provided in the connected documents. The available material only reiterates that systemd v233 and earlier mishandle usernames starting with digits, with no additional vendor/version or remediation specifics.

CVE-2017-1000082

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit e.g. "0day", running the service in question with root privileges rather than the user intended...

Coinbase: Captcha Bypass in Coinbase SignUp Form

Vulnerability description: The g-recaptcha-response is not validated on the server-side when submitting a Signup form to the endpoint. Any or no value can be provided for this header Step to reproduce: 1. https://www.coinbase.com/signup 2. Fill the input field and Validate the captcha. 3. Trun on...

CVE-2017-1000082

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit e.g. "0day", running the service in question with root privileges rather than the user intended...

PT-2017-2827 · Systemd +1 · Systemd +1

Name of the Vulnerable Software and Affected Versions: systemd versions prior to v233 Description: The issue arises from insufficient input validation in the systemd daemon's username parsing functionality, specifically when encountering usernames that start with a numeric digit. This can lead to...

Barracuda WAF V360 Firmware 8.0.1.014 Username / Session ID Leak Vulnerability

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET. Firmware version 8.0.1.014 is affected. Title: Barracuda WAF Management Application Username and Session ID Leak 1. Vulnerability Details Affected Vendor: Barracuda Affected Product: Web...

Teltonika RUT9XX Router Arbitrary Command Execution Vulnerability

Teltonika RUT9XX routers also known as LuCI is a router product from the Lithuanian company Teltonika. A security vulnerability exists in the administration interface of Teltonika RUT9XX routers with firmware version 00.03.265 and earlier. The vulnerability can be exploited by a remote attacker t...