restforce vulnerable to Improper Input Validation

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests. Impact ------ This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods...

Authorization

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests...

CVE-2018-3777

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests...

CVE-2018-3777

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests...

CVE-2018-3777

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests...

CVE-2018-3777

CVE-2018-3777 affects the Ruby gem restforce, prior to version 3.0.0. The vulnerability stems from insufficient URI encoding, allowing an attacker to inject arbitrary parameters into Salesforce API requests. Reported impact includes the ability to override HTTP methods via request parameters (e.g...

Salesforce.com Warns Marketing Customers of Data Leakage SNAFU

Cloud behemoth Salesforce.com is warning customers about an API error that may have leaked data for some users of its Marketing Cloud offering. The issue was in play between June 4 to July 18, according to an alert that Salesforce.com sent out to customers Thursday. The issue potentially affected...

CVE-2018-3777: Improper Input Validation

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests...

PT-2018-16195 · Salesforce · Restforce

Name of the Vulnerable Software and Affected Versions: restforce versions prior to 3.0.0 Description: The issue is related to insufficient URI encoding, allowing an attacker to inject arbitrary parameters into Salesforce API requests. This flaw is only exploitable in applications that pass user...

Insufficient URI encoding in restforce

A flaw in how restforce constructs URL's may allow an attacker to inject additional parameters into Salesforce API requests. Impact ------ This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods...

dowjones.com XSS vulnerability

Open Bug Bounty ID: OBB-643435 Description| Value ---|--- Affected Website:| dowjones.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Common Questions and Answers Salesforce ISVs Need to Know for FedRAMP

Many Salesforce Independent Software Vendors ISVs are interested in pursuing FedRAMP to serve federal customers, but have many questions about the process. The four questions below are the most common questions that Coalfire receives from these ISV partners; we have provided some basic responses ...

Salesforce Careermount - Bypass & Persistent Vulnerability

Document Title: =============== Salesforce Careermount - Bypass & Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1969 Release Date: ============= 2018-07-05 Vulnerability Laboratory ID VL-ID: ===================================...

Salesforce Careermount - Bypass & XSS Web Vulnerability

Document Title: =============== Salesforce Careermount - Bypass & XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1969 Release Date: ============= 2018-07-04 Vulnerability Laboratory ID VL-ID: ====================================...

Salesforce RegistrationForm Cross-Site Scripting Vulnerability

Salesforce.com is an American cloud computing company based in San Francisco, California. A cross-site scripting vulnerability exists in Salesforce RegistrationForm, which could allow an attacker to deliver a manipulated email by injecting malicious script code...

Salesforce RegistrationForm - Persistent Web Vulnerability

Document Title: =============== Salesforce RegistrationForm - Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2054 Salesforce Security ID: 219513 Release Date: ============= 2018-06-22 Vulnerability Laboratory ID VL-ID:...

Salesforce RegistrationForm - Persistent Web Vulnerability

Document Title: =============== Salesforce RegistrationForm - Persistent Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2054 Salesforce Security ID: 219513 Release Date: ============= 2018-06-21 Vulnerability Laboratory ID VL-ID:...

The Dark Side of APIs: Part 1, API Overview

Ryan Barnett, Principal Security Researcher, Akamai Elad Shuster, Senior Security Researcher, Akamai API Overview Application Programming Interfaces API are a software design approach which enables software and system developers to integrate with other systems based on a defined set of...

Salesforce Force (EventRSVP) - Multiple Web Vulnerabilities

Document Title: =============== Salesforce Force EventRSVP - Multiple Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2057 Release Date: ============= 2018-01-03 Vulnerability Laboratory ID VL-ID: ====================================...

Apache OpenNLP XXE Vulnerability

Exploit for multiple platform in category remote exploits CVE-2017-12620 - Apache OpenNLP XXE vulnerability Severity: Medium Vendor: The Apache Software Foundation Versions Affected: OpenNLP 1.5.0 to 1.5.3 OpenNLP 1.6.0 OpenNLP 1.7.0 to 1.7.2 OpenNLP 1.8.0 to 1.8.1 Description: When loading model...