1904 matches found
Cross site request forgery (csrf)
Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery CSRF attacks that can delete a contact from the My Additional Contact page...
CVE-2020-25950
Vulnerability summary (CVE-2020-25950) : A CSRF flaw in Advanced Webhost Billing System 3.7.0 can delete a contact via the My Added Contact page. The affected component is the web application logic handling contact management; the root cause is insufficient validation of request origin for state-...
CVE-2020-25950
Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery CSRF attacks that can delete a contact from the My Additional Contact page...
Awbs Advanced Webhost Billing System 跨站请求伪造漏洞
Awbs Advanced Webhost Billing System is a Php-based web billing management system for managed hosting from Awbs USA. The platform provides web hosting and or domain name registration business services, providing an automated solution for web hosting management. A cross-site request forgery...
Doppler VDP: User Access Control in Community Plan
Summary: Hello, I have found a logical issue in the Billing Subscription section. A given user is able to maintain User Access Control UAC feature in Community Plan. Steps To Reproduce: Setup two accounts let's say Alice and Bob 1. Login using Alice account and create a workspace with any name sa...
Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery (CSRF)
Exploit Title: Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery CSRF Date: 06/01/2021 Exploit Author: Rahul Ramakant Singh Vendor Homepage: https://www.awbs.com/ Version: 3.7.0 Tested on Windows Steps: 1. Login into the application with the help of email and password. 2. Navigat...
Advanced Webhost Billing System 3.7.0 Cross Site Request Forgery
Exploit Title: Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery CSRF Date: 06/01/2021 Exploit Author: Rahul Ramakant Singh Vendor Homepage: https://www.awbs.com/ Version: 3.7.0 Tested on Windows Steps: 1. Login into the application with the help of email and password. 2. Navigat...
SourceCodester Water Billing System SQL Injection (CVE-2020-28183)
An SQL injection vulnerability exists in SourceCodester Water Billing System. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...
Nightflyza Ubilling Command Injection Vulnerability
Nightflyza Ubilling is an open source ISP billing system based on Php, stargazer by Nightflyza individual developers. A security vulnerability exists in Ubilling v1.0.9, which stems from Ubilling allowing remote commands to be executed as the root user. An attacker can exploit the vulnerability t...
CVE-2020-29145
In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or description field to a solutionUnitServlet?SuName=UserReferenceDataSU Access Rights Group. In most test cases, session hijacking was also possible by utilizing th...
Cross site scripting
In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or...
Shopify: Staff with no permissions could possibly list and accept billing promotions
Hi, Description I was looking for undocumented GraphQL API endpoints and noticed a query and mutation related to what seems to be billing promotions, but I'm not 100% sure about this since I have no idea where those promotions would come from. However, since those GraphQL endpoints were found...
CVE-2020-29144
CVE-2020-29144 affects Ericsson BSCS iX R18 Billing & Rating, MX web module, which is vulnerable to stored XSS via an Alert Dashboard comment. The provided documents describe stored XSS as the core issue in the web module, with tests indicating possible session hijacking that could lead to full a...
CVE-2020-29144
In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases, session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover, or...
CVE-2020-29145
The CVE-2020-29145 entry concerns Ericsson BSCS iX R18 Billing & Rating iX R18, where the ADMX web-based module is vulnerable to stored XSS via the name or description fields in the solutionUnitServlet?SuName=UserReferenceDataSU Access Rights Group. The description and related connected records c...
Ericsson BSCS iX R Billing & Rating Cross-Site Scripting Vulnerability
Ericsson Ericsson BSCS iX R18 Billing & Rating is a web platform for telecom billing from Ericsson Sweden. Ericsson BSCS iX R18 Billing & Rating iX R18 suffers from a cross-site scripting vulnerability that stems from the MX web base module being vulnerable to stored XSS via warning dashboard...
Ericsson BSCS iX R18 Billing & Rating Cross-Site Scripting Vulnerability
Ericsson Ericsson BSCS iX R18 Billing & Rating is a web platform for telecom billing from Ericsson, Sweden. Ericsson BSCS iX R18 Billing & Rating iX R18 suffers from a cross-site scripting vulnerability that originates in the ADMX web base module and is susceptible to stored XSS via the name or...
New malware fraudulently subscribes victims to premium phone services
By Sudais Asif If you believe you may have been affected by WAPDropper malware, you should uninstall any suspicious applications and inspect your billing records. This is a post from HackRead.com Read the original post: New malware fraudulently subscribes victims to premium phone services...
SourceCodester Water Billing System SQL Injection Vulnerability
SourceCodester Water Billing System is a water billing system from SourceCodester USA. A SQL injection vulnerability exists in SourceCodester Water Billing System version 1.0, which stems from a failure of the program to properly validate user input, and allows an attacker to perform SQL injectio...
