Khan Academy: The web app's forgot password page is vulnerable to text injection/content spoofing

An attacker will exploit this by chaining it with CSRF there is not protection against CSRF for that page as scenario can only be created by a POST request. The attacker will target innocent users by doing this and some of them would fall in trap by calling the number or by sending the email. Mor...

FreeBSD : moodle -- multiple vulnerabilities (3ddcb42b-5b78-11e6-b334-002590263bf5)

Marina Glancy reports : - MSA-16-0019: Glossary search displays entries without checking user permissions to view them - MSA-16-0020: Text injection in email headers - MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course %NASLMINLEVE...

Phabricator: Error page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

moodle -- multiple vulnerabilities

Marina Glancy reports: MSA-16-0019: Glossary search displays entries without checking user permissions to view them MSA-16-0020: Text injection in email headers MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course...

Nextcloud: Content Spoofing/Text Injection - docs.nextcloud.org

Issue: ====== Hey, I've found content spoofing also known as "Text Injection" in your sub-domain docs.nextcloud.org URL: ------- Here is the malicious URL: https://docs.nextcloud.org/.htacessCONTENT%20SPOOFING%20BY%20AHSAN Fix: Use custom 403 error page which doesn't contain user's text! I hope...

SecNews: Text injection on error page.

An user or attacker is able to inject his text into error page and can trap to user to visit malicious sites. Even if the XSS or error custom based 404 pages error injecting is not on the scope of our program,our committee decided to disclose it publicly...

Veris: Text injection can be used in phishing 404 page and should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : http://veris.in/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one As you ca...

LocalTapiola: Content Spoofing or Text Injection (404 error page injection on yrityspalvelu)

Vulnerability Description: Application allows users to inject any content on the 404 not found webpage Vulnerable Location: https://yrityspalvelu.tapiola.fi/a1/has%20been%20changed%20by%20a%20new%20one%20https://www.attacker.com%20so%20go%20to%20the%20new%20one%20since%20this%20one Fix : just use...

Vimeo: Error page Text Injection.

Error page text injection...

Trello: Error Page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

Gratipay: text injection in website title

Hi, I would like to report an incomplete fix of 115284 , text can inject in website title , see attached files. Regards...

Uber: text injection in get.uber.com/check-otp

Text Injection no HTML or JS in a landing page on get.uber.com...

ownCloud: owncloud.help: Text Injection

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing Text injection can be used in phishing 404 page should not include attacker text The bug exists at :...

withinsecurity: text injection can be used in phishing 404 page should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : https://withinsecurity.com/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20on...

Algolia: text injection can be used in phishing 404 page should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : https://www.algolia.com/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one...

Content Spoofing in AppPortalPage

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce:...

Content Spoofing in AppPortalPage

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce:...

Content Spoofing in AppPortalPage

A third party scan found that the ConvertIssue.jspa action is vulnerable to content spoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce:...

Multiple HTML Injection Vulnerabilities in Dolibarr

Dolibarr is a WEB-based open source ERP and CRM system . Dolibarr suffers from multiple HTML injection vulnerabilities due to the program failing to adequately filter user-submitted input. The vulnerabilities could be exploited to allow an attacker to execute arbitrary script code in the context ...

Content Spoofing in the createrssfeed action

A third party scan found that createrssfeed action is vulnerable to content spoofing|https://www.owasp.org/index.php/ContentSpoofing, in specific text injection. In this case the content spoofing may be used to perform a phishing attack on users. How to reproduce: 1. go to...