regencyfuneralhome.com XSS vulnerability

Open Bug Bounty ID: OBB-454224 Description| Value ---|--- Affected Website:| regencyfuneralhome.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

letswatchseries.ac XSS vulnerability

Vulnerable URL: http://www.letswatchseries.ac/episode.php?episode=battlegrounds1e12-164653.html%22%27/%3E;%3C/style%3E%3Cscript%3Ea=eval;b=alert;ab/XSSPOSED/;%3C/script%3E%27%22%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly...

HackerOne: HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms

Summary: I noticed that HackerOne career pages loads it's application forms from Greenhouse.io via an iframe. The ghjid parameter value is taken into the iframe element for the token parameter in the iframe URL boards.greenhouse.io. Any html characters are escaped in order to avoid XSS and possib...

sbicard.com XSS vulnerability

Vulnerable URL: https://www.sbicard.com/en/search.page?q=how%2520can%2520i%2520check%2520the%2520transactions%2520on%2520my%2520sbi%2520cardalert'OpenBugBounty'...

WordPress: antispambot does not always escape <, >, &, " and '

The antispambot function escapes some randomly selected characters from its first argument, for example: , &, ", or '. These last five characters should always be escaped. There is a chance that this will print out unescaped: console.log"hello";'; Even though the chance of this happening is low,...

steuerberaten.de XSS vulnerability

Vulnerable URL: https://www.steuerberaten.de/doityourself/newsletter/index.php?a= Details: Description| Value ---|--- Patched:| Yes, at 22.12.2017 Latest check for patch:| 22.12.2017 16:30 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 203159 VIP website status...

esquareworld.com XSS vulnerability

Open Bug Bounty ID: OBB-453470 Description| Value ---|--- Affected Website:| esquareworld.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

singaporebrides.com XSS vulnerability

Vulnerable URL: https://singaporebrides.com/search.php Details: Description| Value ---|--- Patched:| Yes, at 18.12.2017 Latest check for patch:| 18.12.2017 22:00 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 230454 VIP website status:| No Coordinated Disclosur...

snowtime.nl XSS vulnerability

Vulnerable URL: https://www.snowtime.nl/aanbod/?datum=%3Cscript%3Ealert1%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1958227 VIP website status:| No Coordinated Disclosure Timeline: Description|...

massey.ac.nz XSS vulnerability

Open Bug Bounty ID: OBB-453225 Description| Value ---|--- Affected Website:| massey.ac.nz Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

hs-fresenius.de XSS vulnerability

Vulnerable URL: https://www.hs-fresenius.de/?type=183hsfexpertsajaxname="/'"II Details: Description| Value ---|--- Patched:| Yes, at 15.12.2017 Latest check for patch:| 15.12.2017 13:07 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 150539 VIP website status:| ...

GSA Bounty: SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent

I've identified an SQL injection vulnerability in the website labs.data.gov that affects the endpoint /dashboard/datagov/csvtojson and can be exploited via the User-Agent HTTP header. I didn't extracted any data from the database, I've confirmed the vulnerability using sleep SQL queries with...

Deconf: Unauthenticated Reflected XSS in admin dashboard

The researcher has identified a Reflected XSS vulnerability within an analytics report of our plugin. The report was well documented, providing a step-by-step PoC to demonstrate the vulnerability...

populusgroup.com XSS vulnerability

Vulnerable URL: http://www.populusgroup.com///search-page?q=';alert/XSSPOSED///';alert/XSSPOSED///";alert/XSSPOSED///";alert/XSSPOSED///--alert/XSSPOSED/...

shopify-scripts: mruby heredoc notation

Hi There exists a vulnerability in mruby when using the heredoc notation it doesn't need ulimit The minified test can be generated with the following command: ruby -e 'IO.binwrite"j3.rb", "\xa7 This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent...

LocalTapiola: PHPMYADMIN Setup is accessible without authentication on https://lml.lahitapiola.fi/

Vulnerability Detail PhpMyAdmin setup page is accessible over the internet in which it's possible for the user setup the servers with required details. Vulnerable Endpoint https://lml.lahitapiola.fi/admin/phpMyAdmin/setup/index.php Attached screenshots F246247 F246248 Impact Its possible for an...

xiaomi-store.cz XSS vulnerability

Open Bug Bounty ID: OBB-452554 Description| Value ---|--- Affected Website:| xiaomi-store.cz Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

peekyou.com XSS vulnerability

Open Bug Bounty ID: OBB-452211 Description| Value ---|--- Affected Website:| peekyou.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

legayapi.com XSS vulnerability

Vulnerable URL: http://legayapi.com/arama Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerability...

fontanaarte.com XSS vulnerability

Open Bug Bounty ID: OBB-451781 Description| Value ---|--- Affected Website:| fontanaarte.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...