20626 matches found
Reflected XSS in "cbSurvey" module
Description Reflected XSS due to bad sanitization of "idstring" parameter in cbSurvey module. Proof of Concept https://demo.corebos.com/index.php?module=cbSurvey&action=cbSurveyAjax&file=MassEdit&mode=ajax&idstring=" onfocus=javascript:alertdocument.domain type=txt autofocus="...
topsyntax.com Cross Site Scripting vulnerability OBB-2681821
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
theteamcompanies.com Cross Site Scripting vulnerability OBB-2680462
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
firmenregister.de Cross Site Scripting vulnerability OBB-2678794
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
esllearningbydesign.com Cross Site Scripting vulnerability OBB-2678416
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
shantnivas.de Cross Site Scripting vulnerability OBB-2676718
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Improper storage of authorization cookie on HTTPs pages
The authorization cookie used by the panel pufferauth is stored in the browser without using HttpOnly or Secure flags on the cookie...
Null pointer dereference in function diff_check
Description Null pointer dereference in function diffcheck at diff.c:1923 Version commit 8eba2bd291b347e3008aa9e565652d51ad638cfa HEAD, tag: v8.2.5151 Proof of Concept guest@elk:/trung/vim2/src$ valgrind ./vim -u NONE -i NONE -n -m -X -Z -e -s -S /home/guest/trung/poc/poc22 -c :qa! ==4357==...
scopeland.de Cross Site Scripting vulnerability OBB-2671681
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
bouncerentalsolutions.com Cross Site Scripting vulnerability OBB-2666582
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
euskalpilota.org Cross Site Scripting vulnerability OBB-2665061
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Nextcloud: SSRF via potential filter bypass with too lax local domain checking
Summary: Hi. Reviewing the code for filtering for ssrf, in preventLocalAddress, we can see that it calls the function ThrowIfLocalAddress. It has three common checks, first, it checks if the string is localhost, or if it ends in .local or .localhost php // Disallow localhost and local network if...
dealscanner.io Cross Site Scripting vulnerability OBB-2658539
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
MAL-2022-157 Malicious code in @bugbounty-automation/deps-json-webpack-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cc3cb3b06f569513ecf3acdd6f2dde149853d34f3ea68ada80288bfb074e9b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
budapestajto.com Cross Site Scripting vulnerability OBB-2658067
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
burchphoto.com Cross Site Scripting vulnerability OBB-2657199
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Nextcloud: Generated passwords are not fully validated by HIBPValidator
Summary: If the Nextcloud server generates a secure random password e.g. for sharing files, the validation is checked before the shuffle function strshuffle is called. In very rare cases it could happen, that a password is validated by HIBPValidator before strshuffle, but would not validate after...
accedacris.ulpgc.es Cross Site Scripting vulnerability OBB-2652840
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
ffl.kohavt.org Cross Site Scripting vulnerability OBB-2652760
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
poweroftruth.net Cross Site Scripting vulnerability OBB-2652686
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...