directory.5280.com Cross Site Scripting vulnerability OBB-4040183

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Affiliate Manager Plugin < 6.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Affiliate Manager Type Plugin Vulnerable versions 6.5.1 Fixed in 6.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5280 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0fe8966b39d9 Credits caon Required...

CVE-2024-5280

creationtimestamp| type| source ---|---|--- 2024-07-13 08:49:50+00:00| seen| https://t.me/cvedetector/809...

CVE-2024-5280 WP Affiliate Platform < 6.5.1 - POST Reflected XSS

The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack...

CVE-2024-5280 WP Affiliate Platform < 6.5.1 - POST Reflected XSS

The wp-affiliate-platform WordPress plugin before 6.5.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make non-logged in users execute an XSS payload via a CSRF attack...

WordPress 5280 Bootstrap Modal Contact Form Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software 5280 Bootstrap Modal Contact Form Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0847 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 00ef5df5a2aa Credits...

directory.5280.com Cross Site Scripting vulnerability OBB-3854395

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-5280

creationtimestamp| type| source ---|---|--- 2023-09-29 22:37:56+00:00| seen| https://t.me/cibsecurity/71329...

CVE-2023-5280 SourceCodester Engineers Online Portal my_students.php sql injection

A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file mystudents.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has bee...

SUSE CVE-2018-5280

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens...

5280.com Cross Site Scripting vulnerability OBB-2864312

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GO-2022-0434 Panic during certificate parsing on Darwin in crypto/x509

Verifying certificate chains containing certificates which are not compliant with RFC 5280 causes Certificate.Verify to panic on macOS. These chains can be delivered through TLS and can cause a crypto/tls or net/http client to crash...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Speex vulnerability (USN-5280-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5280-1 advisory. It was discovered that Speex incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service...

Mozilla Firefox Security Advisory (MFSA2016-85) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

SUSE: Security Advisory (SUSE-SU-2016:2431-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2016:2434-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sagemcom F@ST 5280 routers elevation of privilege vulnerability

Sagemcom F@ST 5280 routers is a router product. A deserialization vulnerability exists in firmware version 1.150.61 in the Sagemcom F@ST 5280 routers, which originates when any authenticated user performs an elevation of privilege on any other user. An attacker could exploit the vulnerability to...

CVE-2020-24034

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...

CVE-2020-24034

CVE-2020-24034 affects Sagemcom F@ST 5280 routers running firmware version 1.150.61. The issue is an insecure deserialization in the authenticated flow that lets a logged-in user alter a serialized session cookie (sess_id, nonce, ha1) to assume another user’s role, including an internal account w...

CVE-2020-24034

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...