marmiton.org XSS vulnerability

Vulnerable URL: http://www.marmiton.org/partenaires/accordsmetsvins/encart.aspx?recipeid=310201"%20onload="alert'OPENBUGBOUNTY'" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3155...

HNB 1.9.18-10 - Local Buffer Overflow

HNB 1.9.18-10 - Local Buffer Overflow Exploit developed using Exploit Pack v5.4 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: HNB - Organizer Version: 1.9.18-10 Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org Program...

duckdns.org XSS vulnerability

Vulnerable URL: https://www.duckdns.org/install.jsp?tab="-alert'OPENBUGBOUNTY'-" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 28307 VIP website status:| Yes Check duckdns.org SSL...

respite.redcross.org.au XSS vulnerability

Open Bug Bounty ID: OBB-154581 Description| Value ---|--- Affected Website:| respite.redcross.org.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-1596

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

info.malwarebytes.org XSS vulnerability

Vulnerable URL: http://info.malwarebytes.org/acton/fs/blocks/showLandingPage/a/8327/p/p-0009/t/page/fm/0?s=%3C/title%3E%3C/script/%22-alert%280%29-%22--%3E%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 03.05.2016 Latest check for patch:|...

Disc Organization System (DORG) Remote Version Detection

Detection of Disc Organization System DORG. This script sends an HTTP GET request and checks for the presence of the application. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

DbDat - Db Database Assessment Tool

DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...

Trello: Using WebSocket I can always access organization data even if I am removed

When a user is a member of a team, they are allowed to connect to an update channel that sends them notifications when the team changes. There were some cases where a team member might receive an update that included the name of board that was in their team … even if they weren't a member of that...

Xero: stored xss issue in folder name on go.xero.com/Docs/Folders

A client-side validation bypass issue was reported, which allowed XSS characters to be used for naming folders in https://go.xero.com. This provided a XSS attack vector against users of an Organization. A malicious, authenticated insider within an organisation may have used this attack vector to...

Veris: Critical IDOR - Get Rules of any organization remotely

Hello Team, I have found a critical IDOR using which an attacker can get rules of any organization remotely by just changing the venue id in GET Request. Proof of Concept: Please find the attached screenshots. Best Regards, Hely H. Shah...

Veris: Critical IDOR - Get venue data of any organization remotely

Hello Team, I have found a critical IDOR vulnerability which allows an attacker to get venue data of any organization remotely by just changing the venueid. Proof of Concept: Please find the attached screenshots. Best Regards, Hely H. Shah...

Veris: Critical IDOR - Delete any venue of any organization remotely

Hello Team, I have found a critical IDOR issue which escalates a user privilege and allows and attacker to delete any venue of any organization remotely through his own account by just changing the venue id in DELETE Request. This is again similar to previously reported critical IDORs to delete a...

Veris: Critical IDOR - Delete any group of any organization remotely

Hello Team, I have found a critical IDOR for deleting any groups of any organization remotely. It means an attacker can easily delete any group of any organization from his account by just chaning the groupid in delete request. This is similar to previously reported IDOR to delete any members. So...

Veris: Critical - Insecure Direct Object Reference - Deleting any member of any organization remotely

Hello Team, I have found an extremely critical issue with the help of which an attacker can delete any member of any organization. The vulnerability is Insecure Direct Object ReferenceIDOR which leads to privilege escalation as an attacker can perform such a critical attack from his own account...

greenfield.org XSS vulnerability

Vulnerable URL: http://greenfield.org/?domain=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 03.03.2016 Latest check for patch:| 03.03.2016 00:30 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 21677549 Google...

UBUNTU-CVE-2015-3275

Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...

CVE-2015-3275: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...