133 matches found
Cross-site Scripting (XSS)
prestashop/psemailsubscription is vulnerable to cross-site scripting XSS. The vulnerability exists through the unsanitized values of NWCONDITIONS configuration in psemailsubscription.php...
Stripo Inc: No rate limit in email subscription
I managed to bypass the following report 1029723 please follow the steps below: Description: No rate limit in Email Subscription, you just have to add a fixed throttle in Burp Suite to avoid the 429 response. Note: I will use tempmail in the screenshots PoC Steps: 1. Go to https://stripo.email/ a...
Topcoder: SSRF at https://cognitive.topcoder.com leads to AWS instance metadata due to vulnerable email subscription feature
Summary: Topcoder makes use of Amazons AWS in their web application environment. I noticed a feature that allows a user to subscribe and receive emails from Topcoder. This feature is vulnerable to server side request forgery since it allows a user to supply an arbitrary URL which the application...
WordPress FV Flowplayer Video Player Plugin Information Disclosure Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.FV Flowplayer Video Player is a video player plugin used in it. An information disclosure vulnerability exists in the...
Format string
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI...
CVE-2019-14801
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection...
CVE-2019-14801
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection...
CVE-2019-14801
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection...
CVE-2019-14801
The CVE concerns the FV Flowplayer Video Player WordPress plugin prior to version 7.3.15.727, where an email subscription feature is vulnerable to SQL injection. Affected component: FV Flowplayer Video Player plugin for WordPress; root cause: lack of input validation in SQL statements used during...
CVE-2019-14799
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS...
Cross site scripting
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS...
CVE-2019-14799
The FV Flowplayer Video Player plugin for WordPress (versions prior to 7.3.14.727) exposes an XSS vulnerability via the unauthenticated AJAX endpoint wp-admin/admin-ajax.php, fv_wp_flowplayer_email_signup. An attacker can submit crafted data to the email parameter (e.g., via list=1 and email fiel...
CVE-2019-14799
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS...
FV Flowplayer Video Player <= 7.3.14.727 - SQL Injection
Changelog states: "Security - fix for SQL injection vulnerability in email subscription"...
FV Flowplayer Video Player <= 7.3.14.727 - CSV Export
Changelog states: Security - fix for email subscription CSV export capability available to guest users...
cp.maliver.ru XSS vulnerability
Open Bug Bounty ID: OBB-601882 Description| Value ---|--- Affected Website:| cp.maliver.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
online.email.subscription.centre.1sl-applstore.com XSS vulnerability
Vulnerable URL: http://online.email.subscription.centre.1sl-applstore.com/secure/index.php?em=%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...
Uber: Missing authentication on Notification setting .
Hi , Notification setting link works without cookies so an attacker can steal link from browser histroy and can change notification setting of victim. Notification setting link does not expire even after logout. Steps to reproduce :- 1.Log in as uber rider. 2.Go to profile. 3.Now go to "Manage yo...
X-Cart Email Subscription 'email' Parameter Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/36601/info X-Cart is prone to a cross-site scripting vulnerability in the email subscription component because the application fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to...
[security bulletin] HPSBHF03006 rev.1 - HP Integrated Lights-Out 2 (iLO 2) Denial of Service
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04244787 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04244787 Version: 1 HPSBHF03006 rev....