148 matches found
PT-2024-31603 · Unknown +1 · Flask-Multipass +1
Name of the Vulnerable Software and Affected Versions: Indico versions prior to 3.3.4 Flask-Multipass versions prior to 0.5.5 Description: There is a Cross-Site-Scripting issue during account creation when redirecting to the next URL. Exploitation requires initiating the account creation process...
Indico 安全漏洞
Indico is a feature-rich event management system from Indico Open Source. A security vulnerability exists in Indico versions prior to 3.3.4 that stems from insufficient validation of input when redirecting to nextURL during account creation, which could lead to the execution of malicious scripts...
Cross-Site Scripting (XSS)
indico is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters in confirmation prompts when deleting content, which allows an attacker with at least submission privileges to inject and execute malicious javascript on a victim's browser, when...
GHSA-FMQQ-25X9-C6HM Indico vulnerable to Cross-Site-Scripting via confirmation prompts
Impact There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone else to attempt to delete this content. Considering that event...
Indico vulnerable to Cross-Site-Scripting via confirmation prompts
Impact There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone else to attempt to delete this content. Considering that event...
CVE-2023-37901
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...
Cross site scripting
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...
PYSEC-2023-129
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...
PYSEC-2023-129
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...
CVE-2023-37901
CVE-2023-37901 describes a Cross‑Site Scripting vulnerability in Indico’s confirmation prompts used when deleting content. Exploitation requires at least a submission privilege (e.g., a speaker) and a second user to attempt deletion, with risk heightened by social engineering. The affected softwa...
CVE-2023-37901 Cross-Site-Scripting via confirmation prompts
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...
CVE-2023-37901 Cross-Site-Scripting via confirmation prompts
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...
CVE-2023-37901 Cross-Site-Scripting via confirmation prompts
Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges such as a speaker and then someone...
PT-2023-26171 · Indico · Indico
Name of the Vulnerable Software and Affected Versions: Indico versions prior to 3.2.6 Description: There is a Cross-Site-Scripting issue in confirmation prompts used when deleting content from Indico. Exploitation requires someone with at least submission privileges and then someone else to attem...
Indico Tampering with links (e.g. password reset) in sent emails
Impact An external audit of the Indico codebase has discovered a vulnerability in Indico's URL generation logic which could have allowed an attacker to make Indico send a password reset link with a valid token pointing to an attacker-controlled domain by sending that domain in the Host header. Ha...
GHSA-WGPJ-7C2J-VFJM Indico Tampering with links (e.g. password reset) in sent emails
Impact An external audit of the Indico codebase has discovered a vulnerability in Indico's URL generation logic which could have allowed an attacker to make Indico send a password reset link with a valid token pointing to an attacker-controlled domain by sending that domain in the Host header. Ha...
Insecure Password Reset Function
indico does not perform password reset in a secure manner. An attacker is able to trick the application into sending a password reset link to a user that points to a host controlled by the attacker instead of the actual Indico host via the Host header in the password reset function...
CVE-2021-30185
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link...