20626 matches found
avalonfunding.com Cross Site Scripting vulnerability OBB-1299228
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
merger-one.com Cross Site Scripting vulnerability OBB-1299057
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
barcodeparts.com Cross Site Scripting vulnerability OBB-1297523
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Mail.ru: This Github Repository Seems Leaking "nino.samokat.ru" Source Code
nino.samokat.ru promo site source code was leaked on github.com...
Code Injection in swig/swig
Description SWIG is a compiler that integrates C and C++ with languages including Perl, Python, Tcl, Ruby, PHP, Java, C, D, Go, Lua, Octave, R, Scheme Guile, MzScheme/Racket, Scilab, Ocaml. SWIG can also export its parse tree into XML. One of the python tools of swig include a mkdist.py script...
Node.js third-party modules: [imagickal] Remote Code Execution
I would like to report RCE in imagickal It allows to execute arbitrary commands on the victim's PC Module module name: imagickal version: 4.2.0 npm page: https://www.npmjs.com/package/imagickal Module Description node wrapper for ImageMagick commands Module Stats 42 weekly downloads Vulnerability...
BlockDev Sp. Z o.o: A specially crafted value for the 'Cache-Digest' header causing crash in chat.makerdao.com
A specially crafted value for the 'Cache-Digest' header causing crash...
Mail.ru: Возможность создать канал в группе, в которой пользователь не является админом [my.games]
Privilege escalation in chat management functionality on store.my.games...
GitLab: Able to leak private email of any user given his/her username via graphql
Summary Graphql query user is leaking private email of users query userusername:"" email username Steps to reproduce Step-by-step guide to reproduce the issue, including: Have a account with private email settings Use graphql query to access the private email query userusername:"" email username...
casey.agency Cross Site Scripting vulnerability OBB-1292535
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
OS Command Injection in adrieankhisbe/bundle-phobia-cli
Description BundlePhobia is a tool to help you find the cost of adding a npm package to your bundle. It enables you to query package sizes. The npm-utils.js has a unsanitized exec function which leads to Arbitrary code execution Proof-of-concept const util = require'./npm-utils.js'; let a =...
Shopify: damage to the timeline so that comment fields cannot be displayed or not available to all members in the store
see https://a-alert-b-y000-b-finda.myshopify.com/admin/discounts/416981811222 I tried to make a discount code with a product name and a discount code like: ± ± when I havehtag the product name on the timeline comment and I get a "server error" reply and it causes crashes to the timeline, so...
Acronis: Clickjacking on cas.acronis.com login page
Steps To Reproduce: Create a new HTML file Source code: I Frame Clickjacking Vulnerability Save the file as whatever.html Open document in browser Reference: https://hackerone.com/reports/591432 FIX- The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP...
piranya.com Cross Site Scripting vulnerability OBB-1289684
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
hoteltorrefiore.com Cross Site Scripting vulnerability OBB-1288736
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
bestbikerbands.com Cross Site Scripting vulnerability OBB-1285722
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
LY Corporation: Developer uploaded files missing authentication on LINE GAME Developers site(gdc.game.line.me)
IDOR vulnerability at gdc.game.line.me allowed unauthenticated users to perform brute-force attacks to disclose unauthorized files related to service testing and QA...
ad-effect.com Cross Site Scripting vulnerability OBB-1281569
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
vegaformazione.it Cross Site Scripting vulnerability OBB-1281405
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Nextcloud: Stored XSS in collabora via user name
Affected: collabora and nextcloud Ubuntu 18.04.5 LTS Nextcloud 19.0.1 snap version collabora CODE The name of the user is displayed when him joins to edit the document allowing the attacker trigger xss. Impact Set the name of the attacker account to Create a new document → share the document with...