CVE-2018-14501

manager/adminajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "mid=1 AND SLEEP5" substring...

drake.lnk.to XSS vulnerability

Open Bug Bounty ID: OBB-652109 Description| Value ---|--- Affected Website:| drake.lnk.to Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Rocket.Chat: XSS (stored) Wizard is saving executable code

issue: xssstored Stored XSS occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for later use. The stored input is not correctly filtered. As a consequence, the malicious data will appear to be part of the web site and run...

Kubernetes Dashboard Public WAN (Internet) / Public LAN Accessible

The script checks if the Kubernetes Dashboard UI is accessible from a public WAN Internet / public LAN. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

kimidora.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-650241 Description| Value ---|--- Affected Website:| kimidora.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-14387

An issue was discovered in WonderCMS before 2.5.2. An attacker can create a new session on a web application and record the associated session identifier. The attacker then causes the victim to authenticate against the server using the same session identifier. The attacker can access the user's...

CVE-2018-14387

Vulnerability : CVE-2018-14387 affects WonderCMS prior to 2.5.2. Root cause : session fixation allowing an attacker to create a session, obtain its identifier, and cause the victim to authenticate using the same session. Impact : attacker can access the user’s account through the active session o...

HomeAdvisor Pro - EntityHash Auth Bypass Vulnerability

Document Title: =============== HomeAdvisor Pro - EntityHash Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1557 Video: https://www.vulnerability-lab.com/getcontent.php?id=1929 Release Date: ============= 2018-07-18 Vulnerabili...

HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability

Document Title: =============== HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1452 Release Date: ============= 2018-07-18 Vulnerability Laboratory ID VL-ID: ====================================...

Barracuda Cloud Control v3.020 - CS XSS Web Vulnerability

Document Title: =============== Barracuda Cloud Control v3.020 - CS XSS Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=662 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ==================================== 6...

HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability

Document Title: =============== HomeAdvisor - Filter Bypass & CS Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1452 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID: ====================================...

SemCms php version V2.7 suffers from SQL Injection Vulnerability

SemCms is an open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers. SemCms php version V2.7 SQL injection vulnerability , attackers can use the vulnerability to obtain sensitive...

CVE-2018-14068

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...

Cross site scripting

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a...

CVE-2018-1255

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a...

CVE-2018-1255 Reflected Cross-Site Scripting Vulnerability

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a...

ModSecurity Cross-Site Scripting Vulnerability

ModSecurity is a Web Application Firewall WAF developed by Trustwave's SpiderLabs team. A cross-site scripting vulnerability exists in ModSecurity version 3.0.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

[SECURITY] Fedora 28 Update: jetty-9.4.11-2.v20180605.fc28

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server like Apache in ord er to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate...

Moodle CMS <= 3.1.12, 3.2.x, 3.3.x <= 3.3.6, 3.4.x <= 3.4.3, 3.5.0 Multiple Vulnerabilities - Linux

Moodle CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

CVE-2016-0708

CVE-2016-0708 affects Cloud Foundry deployments using the Cloud Foundry Java Buildpack (versions 2.0–3.4). Vulnerable when apps are staged with automatic buildpack detection, pass the Java Buildpack detection script, and serve static content from the deployed artifact; the default Tomcat configur...