5267 matches found
Stored Cross Site Scripting (XSS) via "properties" during creating new users
Description From demo url login click people icon at the left bar click "Customers" Click "New Customer" button from page Fill up the "Edit" tab Click "Save" button above Click "Properties" tab From "Add a custom Property" field , add "Test" on the first field Click and select "text" on the secon...
Malicious code in sa-kws-demo-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bdabb0812c58a2425faecb44f731fee2fcff9cadbbe1dfad404dbff229c36b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5901 Malicious code in sa-kws-demo-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bdabb0812c58a2425faecb44f731fee2fcff9cadbbe1dfad404dbff229c36b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
demo.myext.ru Cross Site Scripting vulnerability OBB-2846522
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Malicious Package
Overview kwaishop-digital-access-demo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...
What We’re Looking Forward to at AWS re:Inforce
AWS re:Inforce 2022 starts tomorrow — Tuesday, July 26th — and we couldn't be more excited to gather with the tech, cloud, and security communities in our home city of Boston. Here's a sneak peek of the highlights to come at re:Inforce and what we're looking forward to the most this Tuesday and...
Malicious code in stripe-demo-connect-standard-saas-platform (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5cafd56f9364c09c2668c7979765cad3c44a8090978dadf22d3806503bb661b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Improper Input Validation
Description Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. When software does not validate input properly, an attacker is able to cra...
Cross-Site Request Forgery (CSRF)
Description CSRF is still possible on the Leads module Detailed Video is attached Proof of concept. Tested from: Firefox URL of Demo : https://demo.corebos.com/index.php?module=Leads&action=index&record=&relmodule=Leads Proof of Concept Video Link : https://vimeo.com/732211543 Steps Involved 1...
Malicious code in sales-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2995b7c22f69973ba566c7dfb2c02a0160171de02c8de740fb5c489ade3dce71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5912 Malicious code in sales-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2995b7c22f69973ba566c7dfb2c02a0160171de02c8de740fb5c489ade3dce71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-23173
this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get a...
Gallia - Extendable Pentesting Framework
Gallia is an extendable pentesting framework with the focus on the automotive domain. The scope of gallia is conducting penetration tests from a single ECU up to whole cars, with the main focus on the UDS interface. Taking advantage of this modular design, the logging and archiving functionality...
CVE-2022-23173
this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs to access the "Login menu - demo site" then he can see in this menu all the functionality of the application. If the attacker will try to click on one of the links, he will get a...
Reflected XSS in multiple parameters
Testing Environment 1. Windows OS 2. Firefox Browser Vulnerable URLs ----...
Malicious Package
Overview ethmoji-js-demo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...
Malicious Package
Overview 1uphealth-demo-web-app is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious Package
Overview react-video-live-demo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious Package
Overview sales-demo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious code in ethmoji-js-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34b3e9fb116b32c332ccbd4ad178a22a8aad613494a223d2fba755ff689eaad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...