U.S. Dept Of Defense: Unencrypted __VIEWSTATE parameter in a DoD website

Hi there i realise that the information passing to the server in the subdomain http://████████ can be seen without any encryption thought the VIEWSTATE Parameter. To reduce the change of someone interception the information the parameter should be encrypted due to the sensivity of the information...

Junos OS: Denial of Service in J-Web

A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenticate or to perform J-Web operations. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series;...

CVE-2018-2470

In SAP NetWeaver Application Server for ABAP, from 7.0 to 7.02, 7.30, 7.31, 7.40 and from 7.50 to 7.53, applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-20549)

IBM Rational Quality Manager RQM is a collaborative, Web-based quality management solution from IBM. The program provides test planning and test evaluation management methods within the entire software development lifecycle, and the ability to share information, automation to accelerate the proje...

YUNUCMS cross-site scripting vulnerability (CNVD-2018-20067)

YUNUCMS is China Yunyou YUNU network technology company of a set of open source enterprise station building content management system CMS. YUNUCMS 1.1.4 version of the index.php/index/category/index page there is a cross-site scripting vulnerability, a remote attacker can take advantage of the...

Navigate CMS 2.8 Cross Site Scripting

Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web vulnerability has been discovered in the...

SeaCMS cross-site scripting vulnerability (CNVD-2018-20093)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the admindatarelate.php file in SeaCMS version 6.64. A remote attacker can exploit this...

Navigate CMS 2.8 - Cross-Site Scripting

Navigate CMS 2.8 - Cross-Site Scripting Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-09-19 Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web...

Adobe ColdFusion Arbitrary File Upload Vulnerability

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. An arbitrary file upload vulnerability exists in Adobe ColdFusion. An attacker can exploit the vulnerability to upload arbitrary...

PHP Scripts Mall Olx Clone Cross-Site Scripting Vulnerability

PHP Scripts Mall Olx Clone is a responsive advertising website system script by PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Olx Clone version 3.4.2, which can be exploited by remote attackers to inject arbitrary web script or HTML...

PYSEC-2018-54

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

DamiCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19082)

DamiCMS is a content management system CMS for building websites quickly. A cross-site request forgery vulnerability exists in the admin.php?s=/Admin/doedit URL in DamiCMS version 6.0.0, which can be exploited by a remote attacker to change the password of an administrator account...

waimai Super Cms Cross-Site Request Forgery Vulnerability (CNVD-2018-19089)

waimai Super Cms is a takeaway ordering system. The system is compatible with IE, Firefox, Chrome, Safari and Opera browsers. A cross-site request forgery vulnerability exists in waimai Super Cms 20150505, which can be exploited by a remote attacker to change the configuration with the help of th...

CVE-2018-16366

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...

Joomla! cross-site scripting vulnerability (CNVD-2018-17502)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site scripting vulnerability exists in Joomla! versions prior to 3.8.12 that stems from the program failing to adequately filter output. A...

Infoblox NetMRI Cross-Site Scripting Vulnerability

Infoblox NetMRI is a suite of network automation products from Infoblox, Inc. that provides automated network discovery, switch port management, network change automation, and continuous configuration compliance management for routers, switches, and other network devices. A cross-site scripting...

Explainer Series: What is Clickjacking?

Here we go, another online trap ready to ensnare unsuspecting – well, until now anyway – users. As if Phishing, Cryptojacking, credential stuffing and old school scamming wasn’t enough, folks really just can’t catch a break these days. Anyway, we’re here to chat about clickjacking, for those of y...

ZOHO ManageEngine ADManager Plus HTML Injection Vulnerability

ZOHO ManageEngine ADManager Plus is an IT operations management software. ZOHO ManageEngine ADManager Plus suffers from an HTML injection vulnerability that can be exploited by attackers to allow HTML injection...

WordPress Plugin Chained Quiz SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Chained Quiz, which can be exploited by attackers to execute...

Acunetix WVS 10.0 Build 20150623 Denial Of Service

Exploit Title : Acunetix Web Vulnerability Scanner 10.0 Build 20150623 - Denial of Service PoC Discovery by: Javier Enrique Rodriguez Gutierrez Discovery Date : 2018-08-11 Vendor Homepage: https://www.acunetix.com Tested Version : 10.0 Vulnerability Type : Denial of Service PoC Tested on OS :...