1830 matches found
racius.com Cross Site Scripting vulnerability OBB-2320363
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Acronis: Missing brute force protection on login page on www.acronis.com
A missing brute force protection vulnerability was discovered on the login page of www.acronis.com. This allowed attackers to launch brute force attacks on user accounts, potentially leading to unauthorized access...
[IT 管理者むけ] Active Directoryのセキュリティ強化への対応をご確認ください
2021 年 11 月以降のセキュリティ更新プログラムには、脆弱性を解決するために、Active Directory における 4 件のセ...
CVE-2021-20038
creationtimestamp| type| source ---|---|--- 2021-12-08 12:23:42+00:00| seen| https://t.me/cibsecurity/33566 2021-12-09 11:10:00+00:00| seen| https://t.me/truesecator/2424 2022-01-11 02:27:37+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1299 2022-01-11 18:24:46+00:00|...
Cross-site Request Forgery (CSRF)
ssddanbrown/bookstack is vulnerable to cross-site request forgery attacks. The library does not properly validate the user login flow after the email confirmation, allowing an attacker to duplicate the username and gain access to the account when user click the confirmation link...
CVE-2021-44515
creationtimestamp| type| source ---|---|--- 2021-12-04 06:14:16+00:00| exploited| https://t.me/thehackernews/1705 2021-12-04 15:55:58+00:00| exploited| https://t.me/cKure/8329 2021-12-07 15:59:29+00:00| exploited| https://t.me/truesecator/2416 2021-12-08 20:34:22+00:00| exploited|...
CVE-2021-43791
Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...
Design/Logic Flaw
Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...
CVE-2021-43791
Zulip 4.x vulnerability (CVE-2021-43791): Expired invitation confirmation keys were not properly validated in the new account registration flow. The check_prereg_key_and_redirect step validated the key, but /accounts/register/ did not, allowing registration with an expired key. Impact: potential ...
Zulip 代码问题漏洞
Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a code issue vulnerability that stems from improper design or implementation during the code...
Lark Technologies: Full read SSRF via Lark Docs `import as docs` feature
A SSRF server side request forgery vulnerability was found in the LarkDocs using the "import as docs" feature, which could have potentially been used to access services running on the internal network. We thank @sirleeroyjenkins for reporting this to our team and confirming the resolution...
CVE-2021-41569
creationtimestamp| type| source ---|---|--- 2021-11-19 20:17:08+00:00| seen| https://t.me/cibsecurity/32718 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-41569.yaml 2024-11-22 00:00:00+00:00| seen| The Shadowserver...
CVE-2021-21700
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...
CVE-2021-21700
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...
CVE-2021-21700
CVE-2021-21700 affects the Jenkins Scriptler Plugin. Documents confirm a stored XSS in Scriptler Plugin versions 3.3 and earlier caused by failing to escape the name of scripts on the UI during deletion confirmation. The vulnerability can be exploited by attackers who can create Scriptler scripts...
CVE-2021-21700
Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...
Jenkins 跨站脚本漏洞
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A cross-site scripting vulnerability exists in the Jenkins Plugin, which stems from the Scriptler plugin version 3.3 and...
Stored XSS vulnerability in scriptler
scriptler 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create Scriptler scripts. scriptler 3.4 escapes the name of scripts on the UI when asking...
Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack
Description Login CSRF via /register/confirm/token endpoint. Proof of Concept 1: Register account with the same username as our victim, an email confirmation will take place 2: Retrieve token from email. 3: Send a link http://BOOKSTACKAPPURL/register/confirm/token to user. 4: When the user clicks...
CVE-2021-42258
creationtimestamp| type| source ---|---|--- 2021-10-23 02:39:32+00:00| exploited| https://t.me/cibsecurity/31084 2021-10-25 22:32:43+00:00| seen| MISP/63ddead6-4b82-414c-ad8e-c516b950b446 2021-10-26 18:55:45+00:00| seen| https://t.me/truesecator/2254 2021-10-27 10:22:02+00:00| exploited|...