mifarma.es Cross Site Scripting vulnerability OBB-2103224

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| mifarma.es ---|--- Open Bug Bounty...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. A vulnerability in the URL sanitization logic of the core parser for form elements allows arbitrary JavaScript execution when inserting malicious content into the editor using the clipboard or APIs, and then submitting the form...

Jens Vagelpohl Products.PluggableAuthService 输入验证错误漏洞

Jens Vagelpohl Products.PluggableAuthService is an open source application by Jens Vagelpohl. The product defines a fully pluggable user folder for use on all Zope sites. A security vulnerability exists in Products.PluggableAuthService before version 2.6.0, which stems from an open redirection...

U.S. Dept Of Defense: Self XSS + CSRF Leads to Reflected XSS in https://████/

Hi Security Team, The form inputs in https://███/ Vulnerable to Self XSS Either the form was vulnerable to CSRF When these two bugs available and attacker could combine them to Perform a Reflected XSS Attack Impact Reflected XSS Execute JS Code in behave of a user System Hosts █████████ Affected...

CVE-2020-13186

An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with knowledge of both a machineID and user GUID to modify data if a user clicked a malicious link...

The vulnerabilities of the Case Form and Local Affiliate Form components of the Oracle Argus Safety platform allow a perpetrator to access or modify data.

The vulnerability of the Case Form and Local Affiliate Form components of the Oracle Argus Safety platform exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to data or modify data using specially...

PT-2021-19199 · Evolucare · Evolucare Ecsimaging

Name of the Vulnerable Software and Affected Versions: EVOLUCARE ECSIMAGING aka ECS Imaging versions 6.21.5 and earlier Description: The issue affects the login form and the password-forgotten form, such as /req password user.php?email=, allowing an attacker to steal data in the database and obta...

CVE-2020-25766

An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page...

CVE-2020-25766

An issue was discovered in MISP before 2.4.132. It can perform an unwanted action because of a POST operation on a form that is not linked to the login page...

Code injection

An issue was discovered in Verint Impact 360 15.1. At wfo/control/signin, the login form can accept submissions from external websites. In conjunction with CVE-2019-12783, this can be used by attackers to "crowdsource" bruteforce login attempts on the target site, allowing them to guess and...

CVE-2019-12784

Verint Impact 360 15.1 (wfo/control/signin) has a login form that accepts submissions from external websites, enabling a possible cross-site flow that, together with CVE-2019-12783, could be used to crowdsource bruteforce login attempts against valid credentials without originating traffic from t...

nu.ac.bd Cross Site Scripting vulnerability OBB-1051697

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| nu.ac.bd ---|--- Open Bug Bounty...

The vulnerability of the Form component in the Symfony software development and web application management platform allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Form component in the Symfony software development and web application management platform exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a specially crafted HTTP request,...

CVE-2013-7479

The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field...

Appointment Hour Booking <= 1.1.45 - Stored Cross-Site Scripting (XSS)

It is possible for an unauthenticated user to inject malicious JavaScript into a booking form, which will then be executed when an authenticated user views the booking in the WordPress admin interface. POST /booking-form/ HTTP/1.1 Host: test.local User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X...

CVE-2019-7435

PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form...

DEBIAN-CVE-2018-19789

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method e.g. setNamestring $name of a class that's the dataclass of a form, and when a...

Rocket.Chat Cross-Site Scripting Vulnerability

Rocket.Chat is an open source built in JavaScript using the Meteor fullstack framework developed by the Web chat server . A cross-site scripting vulnerability exists in the registration form of Rocket.Chat versions prior to 0.66. A remote attacker can exploit this vulnerability to inject arbitrar...

Omeka Cross-Site Scripting Vulnerability

Omeka is a set of Web publishing platforms for exhibiting libraries, museums, archives, and academic collections developed by the Omeka team at the Roy Rosenzweig Center for History and New Media Roy Rosenzweig CHNM at George Mason University USA. A cross-site scripting vulnerability exists in th...

Zimbra Collaboration Suite Cross-Site Request Forgery Vulnerability

Zimbra Collaboration Suite a.k.a. ZCS is an open source collaboration suite from Zimbra, Inc. that includes WebMail, Calendar, Address Book, and more. A cross-site request forgery vulnerability exists in the login form in Zimbra ZCS versions prior to 8.6.0 Patch 10, 8.7.x versions prior to 8.7.11...