CVE-2018-14387

An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The attacker then causes the victim to authenticate against the server using the same session identifier. The attacker can access the user's...

CVE-2018-14387

Vulnerability : CVE-2018-14387 affects WonderCMS prior to 2.5.2. Root cause : session fixation allowing an attacker to create a session, obtain its identifier, and cause the victim to authenticate using the same session. Impact : attacker can access the user’s account through the active session o...

HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability

Document Title: =============== HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1452 Release Date: ============= 2018-07-18 Vulnerability Laboratory ID VL-ID: ====================================...

HomeAdvisor Pro - EntityHash Auth Bypass Vulnerability

Document Title: =============== HomeAdvisor Pro - EntityHash Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1557 Video: https://www.vulnerability-lab.com/getcontent.php?id=1929 Release Date: ============= 2018-07-18 Vulnerabili...

Barracuda Cloud Control v3.020 - CS XSS Web Vulnerability

Document Title: =============== Barracuda Cloud Control v3.020 - CS XSS Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=662 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ==================================== 6...

HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability

Document Title: =============== HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1452 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ====================================...

SemCms php version V2.7 suffers from SQL Injection Vulnerability

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers. SemCms php version V2.7 SQL injection vulnerability , attackers can use the vulnerability to obtain sensitive...

CVE-2018-14068

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...

Cross site scripting

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a...

CVE-2018-1255

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a...

CVE-2018-1255 Reflected Cross-Site Scripting Vulnerability

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a...

ModSecurity Cross-Site Scripting Vulnerability

ModSecurity is a Web Application Firewall WAF developed by Trustwave's SpiderLabs team. A cross-site scripting vulnerability exists in ModSecurity version 3.0.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

[SECURITY] Fedora 28 Update: jetty-9.4.11-2.v20180605.fc28

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

Moodle CMS <= 3.1.12, 3.2.x, 3.3.x <= 3.3.6, 3.4.x <= 3.4.3, 3.5.0 Multiple Vulnerabilities - Linux

Moodle CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

CVE-2016-0708

CVE-2016-0708 affects Cloud Foundry deployments using the Cloud Foundry Java Buildpack (versions 2.0–3.4). Vulnerable when apps are staged with automatic buildpack detection, pass the Java Buildpack detection script, and serve static content from the deployed artifact; the default Tomcat configur...

cashusa.com XSS vulnerability

Open Bug Bounty ID: OBB-644921 Description| Value ---|--- Affected Website:| cashusa.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

AT&T Bizcircle Cross Site Scripting

Document Title: =============== AT&T Bizcircle - Persistent Profile Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2108 AT&T Reference ID: 1502971499862 Vulnerability Magazine:...

Barracuda ADC 5.x Client-Side Script Insertion

Document Title: =============== Barracuda ADC 5.x - Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1425 Release Date: ============= 2018-07-10 Vulnerability Laboratory ID VL-ID:...

Barracuda ADC 5.x Filter Bypass / Cross Site Scripting

Document Title: =============== Barracuda ADC 5.x - Filter Bypass & Persistent Validation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1423 Release Date: ============= 2018-07-09 Vulnerability Laboratory ID VL-ID:...

IBM QRadar SIEM Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'securerandom' class MetasploitModule 'IBM QRadar SIEM Unauthenticated Remote Code Execution', 'Description' = %q IBM QRadar SIEM has three vulnerabilities in th...