CVE-2017-18194

SQL injection vulnerability in users/signup.php in the "signup" component in HamayeshNegar CMS allows a remote attacker to execute arbitrary SQL commands via the "utype" parameter...

CVE-2017-18194

HamayeshNegar CMS is affected in its signup component (users/signup.php). The vulnerability is a SQL injection caused by the utype parameter, allowing a remote attacker to execute arbitrary SQL commands. The exploitation details are not provided in the documents; no patch or remediation steps are...

Authentication flaw

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in th...

earthcam.com XSS vulnerability

Open Bug Bounty ID: OBB-533665 Description| Value ---|--- Affected Website:| earthcam.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

hackaday.io XSS vulnerability

Open Bug Bounty ID: OBB-501311 Description| Value ---|--- Affected Website:| hackaday.io Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure...

airbravocorp.com XSS vulnerability

Open Bug Bounty ID: OBB-456522 Description| Value ---|--- Affected Website:| airbravocorp.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

identureandhearing.com XSS vulnerability

Open Bug Bounty ID: OBB-456521 Description| Value ---|--- Affected Website:| identureandhearing.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

barriekempettes.ca XSS vulnerability

Open Bug Bounty ID: OBB-456497 Description| Value ---|--- Affected Website:| barriekempettes.ca Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

secure.azulstar.com XSS vulnerability

Open Bug Bounty ID: OBB-446802 Description| Value ---|--- Affected Website:| secure.azulstar.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

epost.ca XSS vulnerability

Open Bug Bounty ID: OBB-429236 Description| Value ---|--- Affected Website:| epost.ca Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

stuart.training XSS vulnerability

Open Bug Bounty ID: OBB-417556 Description| Value ---|--- Affected Website:| stuart.training Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ohpadmin.com XSS vulnerability

Open Bug Bounty ID: OBB-385178 Description| Value ---|--- Affected Website:| ohpadmin.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Infogram: Weak Password Policy on Signup

Hi Team, i would like to let you know about password management issue. PoC: 1. Navigate to signup page. 2. Fill you details and give password as simple as 123123. 3. You can see you will be registered and there is no strong enforcement. Fix: Use complex password management. Regards, Mr.R3boot...

New Relic: Captcha Bypass on SignUp Form

The g-recaptcha-response parameter was not validated on the server side when submitting a form to the /signups endpoint. Any or no value could be provided for this parameter...

forvo.com XSS vulnerability

Vulnerable URL: https://forvo.com/signup/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7561 VIP website status:| Yes Coordinated Disclosure Timeline: Description| Value ---|---...

Public Transportation eTraffic App Has Logic Design Flaws

Bus eLutong is a free smartphone-based real-time bus information query software officially released by Beijing Public Transportation Group. There is a logical design vulnerability in Bus eLutong App, which allows an attacker to arbitrarily register a user and reset any user's password by grabbing...

Hiro: Cross site request forgery

An e-mail signup form does not check CSRF tokens. This would allow the creation of click-able links which perform an e-mail signup. Because the e-mail signup form does not pass any sensitive information, nor perform any state changes on behalf of a user, this is not a vector for attack...

sezion.com XSS vulnerability

Vulnerable URL: https://sezion.com/signup?type=FREE%22%3E%3Cscript%3Ealert/OPENBUGBOUNTY/;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 10.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 868920 VIP website status:| N...

GSA Bounty: [api.data.gov] Leak Valid API With out Verification -

Description Remote attackers are able to retrieve a valid working api key with random Generation Process without a secure parsing or secure channel , human verification ..etc . the current proccess for requesting any api key is with signup form , and message with api delivered privately to user ,...

logz.io XSS vulnerability

Open Bug Bounty ID: OBB-264620 Description| Value ---|--- Affected Website:| logz.io Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...