abacus.am Cross Site Scripting vulnerability OBB-3091795

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the execute function due to improper user-input sanitization. PoC js var root =require"abacus-ext-cmdline" root.execute'"& touch JHU &"' Remediation There is no fixed version for abacus-ext-cmdline. Credit: JHU...

MAL-2022-1507 Malicious code in bernie-abacus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51dd3fec2ffe9da46544acc21edd1c8c93b4daac7ae2e59e87734804884800c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bernie-abacus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51dd3fec2ffe9da46544acc21edd1c8c93b4daac7ae2e59e87734804884800c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1065

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019...

CVE-2022-1065

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019...

CVE-2022-1065

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019...

Authentication flaw

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019...

CVE-2022-1065

The CVE-2022-1065 entry describes a vulnerability in the authentication process of Abacus ERP that lets a remote attacker bypass the second authentication factor. Affected are multiple Abacus ERP releases: v2022 versions before R1 (2022-01-15), v2021 before R4 (2022-01-15), v2020 before R6 (2022-...

CVE-2022-1065 Multi Factor Authentication Bypass in various versions of Abacus ERP

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus ERP v2022 versions prior to R1 of 2022-01-15; v2021 versions prior to R4 of 2022-01-15; v2020 versions prior to R6 of 2022-01-15; v2019...

Abacus ERP 多个 授权问题漏洞

Abacus ERP is a solution for managing and controlling commercial companies from the Swiss company Abacus. A security vulnerability exists in multiple versions of Abacus ERP that stems from a problem with the authentication process. A remote attacker could exploit the vulnerability to bypass...

Abacus OAuth Login Cross-Site Scripting Vulnerability

Abacus OAuth Login is a single sign-on software from Abacus Switzerland. A cross-site scripting vulnerability exists in oauth/oauth2/v1/saml/ in version 201901r4201910210000 prior to Abacus OAuth Login R4 20.11.2019 Hotfix, which can be exploited by an attacker to execute JavaScript code in a...

CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

Cross site scripting

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

CVE-2019-19381

Affected product: Abacus OAuth Login. Vulnerable component: oauth/oauth2/v1/saml/ handling. Root cause: reflected XSS triggered by error message in the login flow for version 2019_01_r4_20191021_0000 prior to R4. Impact: could allow execution of JavaScript in a user’s browser (client-side impact)...

CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

online.abacus.coop XSS vulnerability

Open Bug Bounty ID: OBB-648188 Description| Value ---|--- Affected Website:| online.abacus.coop Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Denial Of Service (DoS)

cf-abacus is vulnerable to denial of service DoS attacks. A malicious user can pass multiple invalid tokens to the system, causing it to excessively spend resources to process these invalid tokens, leading to a denial of service...

Google Aims to Kill Passwords with Project Abacus

Google wants to kill passwords. And the weapon it wants to use is called Project Abacus, which Google said will become available on Android devices by the end of 2016. The way Project Abacus works is that instead of relying on passwords or two-factor authentication to open your Android phone, you...