17429 matches found
Security Bulletin: Overly Permissive CORS Policy vulnerability found on IBM Security Secret Server (CVE-2019-4633)
Summary This security bulletin describes plugging some potential, minor yet significant, information leaks by the IBM Security Secret Server. IBM Security Secret Server has an overly permissive CORS policy for login. Vulnerability Details CVEID: CVE-2019-4633 DESCRIPTION: IBM Security Secret Serv...
OLK Web Store 2020 - Cross-Site Request Forgery
Exploit Title: OLK Web Store 2020 - Cross-Site Request Forgery Google Dork: intext:"TopManage ® 2002 - 2020" Date: 2020-01-13 Exploit Author: Joel Aviad Ossi Vendor Homepage: http://www.topmanage.com/ Software Link: http://www.topmanage.com/microsites/olk-web-store/ Version: 2020 Tested on: N/A C...
CVE-2019-16515
An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. Certain HTTP security headers are not used...
Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability
The Cisco Content Security Management Appliance SMA and the Cisco Web Security Appliance WSA are both products of Cisco, Inc.The Cisco Web Security Appliance is a Web security appliance. The appliance provides SaaS-based access control, real-time network reporting and tracking, and the developmen...
CVE-2019-6146
It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...
CVE-2019-6146
It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...
Cross site scripting
It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...
CVE-2019-6146
It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...
CVE-2019-6146
CVE-2019-6146 affects Forcepoint Web Security (version 8.x). The issue is a cross-site scripting (XSS) vulnerability resulting from host header injection in the web application, enabling potential execution of client-side script when a crafted request is processed. The vulnerability is documented...
Cisco Web Security Appliance and Cisco Content Security Management Appliance HTTP Header Injection Vulnerability
A vulnerability in the API Framework of Cisco AsyncOS for Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA could allow an unauthenticated, remote attacker to inject crafted HTTP headers in the web server's response. The vulnerability is due to insufficient...
CVE-2019-12490
An issue was discovered in Simple Machines Forum SMF before 2.0.16. Reverse tabnabbing can occur because of use of blank for external links...
PT-2020-11193
Name of the Vulnerable Software and Affected Versions Forcepoint Web Security versions 8.x Description The issue allows for cross-site scripting XSS via host header injection. This means an attacker could potentially inject malicious scripts into a website, affecting users who visit the site...
CVE-2019-6146: Improper Neutralization of Input During Web Page Generation
It has been reported that cross-site scripting XSS is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 Medium /AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...
PT-2020-1438
Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA and Cisco Content Security Management Appliance SMA affected versions not specified Description The issue is related to insufficient validation of user input in the API Framework, allowing an unauthenticated,...
salemcountryclub.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1071728 Security Researcher N00bSdt Helped patch 123 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting salemcountryclub.org website and its users. Following...
Wordpress Time Capsule Plugin 1.21.16 - Authentication Bypass Exploit
Exploit for php platform in category web applications Exploit Title: Wordpress Time Capsule Plugin 1.21.16 - Authentication Bypass Exploit Author: B. Canavate Vendor Homepage: https://wptimecapsule.com/ Software Link: https://wptimecapsule.com/ Version: Wordpress Time Capsule Plugin 1.21.16 Teste...
Cross site scripting
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...
CVE-2019-17573
CVE-2019-17573 is an XSS vulnerability in Apache CXF affecting WebSphere Application Server Liberty’s WebSphere JAX-WS components via the CXF /services listing page. Public docs confirm the issue and cite the vulnerable surface as CXF’s endpoint listing, with exploitation potentially executing sc...
costa-villas-blue.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1068532 Security Researcher Broly157 Helped patch 1572 vulnerabilities Received 7 Coordinated Disclosure badges Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting costa-villas-blue.com...