Ubuntu 16.04 LTS / 20.04 LTS : Rack vulnerabilities (USN-4561-2)

The remote Ubuntu 16.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4561-2 advisory. USN-4561-1 fixed vulnerabilities in Rack. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 20.04 LTS and Ubuntu...

[SECURITY] Fedora 33 Update: curl-7.71.1-9.fc33

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

Shopify: Stored XSS in /admin/product and /admin/collections

Hello Security Team, I was going through previous reports of XSS and I have found this, https://hackerone.com/reports/978125 As stated by team on this page even on https://hackerone.com/shopify?type=team under Known issues that we can now report XSS under Rich Text Editor on Product description a...

XSS Vulnerability in Mito Enterprise Website Builder System

Mito enterprise building system using PHP MySQL architecture , is a suitable for enterprise building open source free CMS station building system . Mito enterprise website system XSS vulnerability, attackers can use the vulnerability to obtain sensitive information such as administrator cookies...

XSS Vulnerability in Employment Management Services Platform

The employment management service platform mainly realizes the information management of student employment work and enterprise recruitment. XSS vulnerability exists in the Employment Management Service Platform, which can be exploited by attackers to obtain administrator cookies...

Cross-site Scripting (XSS) - Generic in forkcms/forkcms

✍️ Description The forkcms is vulnerable to XSS through adding new media. 🕵️‍♂️ Proof of Concept Payload: . 1. With an authenticated user, access: http://localhost/private/en/medialibrary/mediaitemindex. 2. Select the option Online movies Youtube, Vimeo, ... and click on Next. 3. Select any source...

niceincontact.com Cross Site Scripting vulnerability OBB-1969970

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| niceincontact.com ---|--- Open Bug Boun...

U.S. Dept Of Defense: Elmah.axd is publicly accessible leaking Error Log

Summary ELMAH Error Logging Modules and Handlers is an application-wide error logging facility that is completely pluggable. If ELMAH is not properly configured, the elmah.axd handler can be accessed without authorization. This page will list all the error messages generated by the web applicatio...

Cross-site Scripting (XSS)

Synapse is vulnerable to cross-site scripting XSS attacks. An attacker is able to inject and execute malicious script as the library does not escape loading of HTML files from the default Synapse template directory, allowing access to cookies and other browser data and access to other resources...

DEBIAN-CVE-2021-21332

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The...

Cross site scripting

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The...

PYSEC-2021-133

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The...

CVE-2021-21332

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The...

GHSA-246W-56M2-5899 Cross-site scripting (XSS) vulnerability in the password reset endpoint

Impact The password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources...

Cross-site scripting (XSS) vulnerability in the password reset endpoint

Impact The password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources...

XSS Vulnerability in Ocean CMS V210202

Ocean CMS is a video-on-demand system designed for webmasters with different needs. An XSS vulnerability exists in Ocean CMS V210202. An attacker can exploit this vulnerability to obtain sensitive information such as user cookies...

Apache Synapse 跨站脚本漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A cross-site scripting vulnerability exists in Matrix Synapse versions prior to 1.27.0, which can be exploited by attackers to access cookies and other browser data...

Patreon WordPress < 1.7.0 - Unauthenticated Local File Disclosure

The Jetpack Scan team identified a Local File Disclosure vulnerability in the plugin that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in t...

XSS Vulnerability in Hsycms

Hsycms is a rapid site building system developed by TP5.0 framework. Hsycms has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

Cross-site Scripting (XSS) - Generic in forkcms/forkcms

✍️ Description A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publishondate" Parameter 🕵️‍♂️ Proof of Concept Vulnerable parameter: publishondate XSS payload: '"%26%25alert1 Steps to reproduce issue 1- Login to Fork admin panel 2-...