4images Cross Site Scripting / Clickjacking

Affected software: 4images Type of vulnerability: clickjacking,xss URL: http://www.4homepages.de/ Discovered by: Provensec Website: http://www.provensec.com Description: 4images is a powerful web-based image gallery management system. Features include comment system, user registration and...

CrushFTP 7.2.0 Cross Site Request Forgery / Cross Site Scripting

======================================================== I. Overview ======================================================== Multiple CSRF & Cross-Site Scripting XSS vulnerabilities have been identified in Crushftp 7.2.0 Web Interface on default configuration. These vulnerabilities allows an...

CVE-2014-8110

Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8110

Apache ActiveMQ (5.x) prior to 5.10.1 is affected by cross-site scripting in the web-based admin console (CVE-2014-8110). Attacks could inject script/HTML via unspecified vectors and, per related IBM advisories, could lead to credential theft via cookies. Remote exploitation is possible if expose...

[SECURITY] Fedora 21 Update: mantis-1.2.19-1.fc21

Mantis is a free popular web-based issue tracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a web server. Almost any web browser should be able to function as a client. Documentation can be found in: /usr/share/doc/mantis When t...

ManageEngine Firewall Analyzer Directory Traversal Vulnerability

ManageEngine Firewall Analyzer is a web-based firewall log analysis tool that collects, correlates, analyzes, and reports on logs from firewalls, proxy servers, and Radius servers across the enterprise. A directory traversal vulnerability exists in ManageEngine Firewall Analyzer, which allows...

ManageEngine Firewall Analyzer Cross-Site Scripting Vulnerability

ManageEngine Firewall Analyzer is a web-based firewall log analysis tool that collects, correlates, analyzes, and reports on logs from firewalls, proxy servers, and Radius servers across the enterprise. A cross-site scripting vulnerability exists in ManageEngine Firewall Analyzer that allows...

ManageEngine ServiceDesk Plus User Rights Management Vulnerability

ServiceDesk Plus is web-based helpdesk software that helps users manage all their communications from a single point. A user rights management vulnerability exists in ManageEngine ServiceDesk Plus that allows an attacker to access certain features that are only available to administrative users...

SupportCenter Plus 7.9 Cross Site Scripting Vulnerability

SupportCenter Plus version 7.9 suffers from a cross site scripting vulnerability. Product: SupportCenter Plus Vendor: Zoho Corp. Vulnerable Versions: 7.9 and probably prior Tested Version: 7.9 Advisory Publication: January 7, 2015 without technical details Vendor Notification: January 7, 2015...

Schneider Electric ETG3000 FactoryCast HMI Gateway Unauthorized Access Vulnerability

The Schneider Electric ETG3000 FactoryCast HMI Gateway is a Web-based SCADA system. An unauthorized access vulnerability exists in the Schneider Electric ETG3000 FactoryCast HMI Gateway, which could be exploited by an attacker to gain unauthorized access to sensitive information, such as...

[The ManageOwnage Series, part XI]: Remote code execution in ServiceDesk, Asset Explorer, Support Center and IT360

Hi, This is part 11 of the ManageOwnage series. For previous parts, see 1. This time we have two remote code execution via file upload and directory traversal on several ManageEngine products - Service Desk Plus, Asset Explorer, Support Center and IT360. The first vulnerability can only be...

Codiad short_name Cross-Site Scripting Vulnerability

Codiad is an open source Web-based IDE application for writing and editing code online . A cross-site scripting vulnerability exists in Codiad components/filemanager/dialog.php, which allows injection of arbitrary web script or HTML via the shortname parameter, which can obtain sensitive...

Cross site scripting

Cross-site scripting XSS vulnerability in the web-based device management interface in Palo Alto Networks PAN-OS before 5.0.15, 5.1.x before 5.1.10, and 6.0.x before 6.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Ref ID 64563...

CVE-2014-3764

CVE-2014-3764 : A cross-site scripting (XSS) vulnerability exists in the web-based device management interface of Palo Alto Networks PAN-OS. The issue stems from improper input sanitization, allowing an attacker to inject arbitrary script/HTML via unspecified vectors. Affected PAN-OS versions are...

PHPMyRecipes 1.2.2 - browse.php?category SQL Injection

PHPMyRecipes 1.2.2 - browse.php?category SQL Injection Exploit Title : phpMyRecipes 1.2.2 SQL injectionpage browse.php, parameter category Author : Manish Kishan Tanwar Download Link : http://prdownloads.sourceforge.net/php-myrecipes/phpMyRecipes-1.2.2.tar.gz?download Date : 23/12/2014 Discovered...

Cross-site scripting vulnerability

A cross-site scripting vulnerability exists in the web-based device management interface whereby data provided by the user is echoed back to the user without sanitization. Ref 64563. This vulnerability has been assigned CVE-2014-3764. This issue affects the management interface of the device, whe...

SmoothWall 3.1 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: SmoothWall 3.1 Multiple vulnerabilities Date: 21/12/2014 Author: Yann CAM @ Synetis Vendor or Software Link: www.smoothwall.org - www.smoothwall.org/download/ Version: 3.1 Category: CSRF password reset & XSS persistent Google dork: Tested on: Smoothwall Linux distribution Smoothwal...

CVE-2014-2025 Remote Code Execution (RCE) in "Intrexx Professional"

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2025 =================== "Remote Code Execution RCE via Unrestricted File Upload" CWE-434 vulnerability in "Intrexx Professional" product Vendor =================== United Planet GmbH Product =================== "Intrexx is an integrated...

[SECURITY] Fedora 20 Update: mantis-1.2.18-1.fc20

Mantis is a free popular web-based issue tracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a web server. Almost any web browser should be able to function as a client. Documentation can be found in: /usr/share/doc/mantis When t...

Codiad 2.4.3 Cross Site Scripting / Local File Inclusion Vulnerabilities

Codiad version 2.4.3 suffers from cross site scripting and local file inclusion vulnerabilities. Exploit Title: Codiad - Cross Site Scripting - Local File Inclusion Vulnerability's Date: 19/12/2014 Url Vendor: http://codiad.com/ Vendor Name: Codiad Version: 2.4.3 CVE: CVE-2014-1137 Author:...