Design/Logic Flaw

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. A...

CVE-2017-15580

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. A...

CVE-2017-15580

osTicket 1.10.1 is vulnerable to an arbitrary file upload due to improper validation of uploaded file contents. The vulnerability allows an attacker to upload arbitrary files (e.g., PHP shells) by abusing the HTML upload mechanism, bypassing client-side checks, and changing file extensions to dis...

CVE-2017-15580

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. A...

dotCMS End of Life (EOL) Detection

The dotCMS version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Red Hat katello-headpin SAM web application cross-site scripting vulnerability

Red Hat katello-headpin is a systems management engine from Red Hat that provides configuration management, subscription management, and content management workflows.SAM web application is one of the SAM management applications. A cross-site scripting vulnerability exists in the SAM web applicati...

CVE-2017-12271

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...

CVE-2017-12271

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...

Cisco SPA300 and SPA500 Series IP Phones Cross-Site Request Forgery Vulnerability

A vulnerability in Cisco SPA300 and SPA500 Series IP Phones could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery CSRF protection. An attacker could exploit this vulnerability by tricking...

Bugcrowd Integration Now Available in Qualys Web Application Scanning

The new version of Qualys Web Application Scanning, WAS 5.7, adds an integration with Bugcrowd for centralized viewing and triaging of both WAS automated vulnerability detections and vulnerabilities submitted by Bugcrowd's approved security researchers. Qualys WAS customers running a bug bounty...

presseportal.de XSS vulnerability

Open Bug Bounty ID: OBB-347585 Description| Value ---|--- Affected Website:| presseportal.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pesantren.web.id XSS vulnerability

Vulnerable URL:...

Authentication flaw

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view information and modify settings or execute code remotely...

CVE-2017-9625

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view information and modify settings or execute code remotely...

CVE-2017-9625

An Improper Authentication issue was discovered in Envitech EnviDAS Ultimate Versions prior to v1.0.0.5. The web application lacks proper authentication which could allow an attacker to view information and modify settings or execute code remotely...

DNN Cookie Deserialization Remote Code Execution (CVE-2017-9822)

An object deserialization vulnerability exists in DotNetNuke web content management system. A remote unauthenticated attacker may exploit this vulnerability by sending a crafted file to the web application...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2014-0029

Multiple cross-site scripting XSS vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters...

CVE-2014-0029

CVE-2014-0029 affects the SAM web application in Red Hat katello-headpin (the systems management engine). The connected documents describe multiple cross-site scripting (XSS) vulnerabilities in the SAM web app, allowing remote attackers to inject arbitrary web script or HTML via unspecified param...

CVE-2017-15375

WPJobBoard for WordPress (v4.5.1) contains multiple client-side XSS vulnerabilities in the wpjb-email, wpjb-job, wpjb-application, and wpjb-membership modules. Exploitation targets the query and id parameters; use of GET is sufficient and no privileged account is required. Impact described in sou...