MyCrypto: Content Spoofing or Text Injection support.mycrypto.com

w2w reported a text injection attack where the user could be shown arbitrary text injected via query parameters. The MyCrypto team worked with w2w to resolve these issues, and appreciate the responsible disclosure. We look forward to continuing to work with the security community to triage and...

Tor: Content spoofing on

Vulnerability description not provided...

Tor: Report Regarding Security Vulnerability

Vulnerability description not provided...

Algolia: Text injection on status.algolia.com

Hi Algolia team! I just found a text injection vulnerabilty in status.algolia.com/clusters . Please follow the steps below. Vulnerable URL status.algolia.com Steps to reproduce: Go to Vulnerable URL Add anything you want after the Vulnerable Url. POC LIVE POC F193293 Hope you fix it! Thanks! Sh3r...

Nextcloud: Content Spoofing/Text Injection in https://demo.nextcloud.com

Greetings, Hello Team, I have found a Content Spoofing/Text Injection on this domain https://demo.nextcloud.com PoC URL:https://demo.nextcloud.com/wp-content/cache/minify/%0d%0ahas%20moved%20to%20www.attacker.com.Please%20visit%20attacker.com%20present%20resource PoC Screen Shot: Let me know if y...

Nextcloud: Content Spoofing/Text Injection in nextcloud.com

Greetings, Hello Team, I have found a Content Spoofing/Text Injection on this domain https://nextcloud.com PoC URL: https://nextcloud.com/wp-content/cache/minify/%0d%0ahas%20moved%20to%20www.attacker.com.Please%20visit%20attacker.com%20present%20resource PoC Screen Shot: F168750 Let me know if yo...

CVE-2017-6059

A text injection flaw was found in how modauthopenidc handled error pages. An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs...

Ubiquiti Inc.: Content Spoofing or Text Injection in (403 forbidden page injection) and Nginx version disclosure via response header

Hello there, I know that this is Non-critical issue but i want you guys to be aware of it. 1. I have found a Content Spoofing or Text Injection in This url http://dl-origin.ubnt.com/ Go to this url...

CVE-2016-5013

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

CVE-2016-5013

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

CVE-2016-5013

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

CVE-2016-5013

CVE-2016-5013 affects Moodle 2.x and 3.x, where text injection can occur in email headers, potentially enabling outbound spam. The available sources describe the affected software and the vulnerability class but do not provide exploitable vectors, affected versions beyond Moodle 2.x/3.x, or concr...

Urban Dictionary: Text injection on Auth problem at urbandictionary.com

A text injection bug was found and fixed. Simple text injection over Logout IDOR at Urban Dictionary :...

LocalTapiola: Error Page Content Spoofing or Text Injection (viestinta.lahitapiola.fi)

Hi team! I want to report a context spoofing or text injection at the new scope added viestinta.lahitapiola.fi Vulnerability Description: The new scope allows users to inject any content on the 404 not found webpage Vulnerable Location:...

Yelp: Error Page Text Injection

Hello Yelp team, Description : An attacker is able to inject his own text into error page and can fool the victim to visit his own malicious site. Please take a look at attached document, it contains POC as well as attack scenario about how the attacker can exploit this vulnerability and...

Udemy: Content Spoofing in udemy

Scenerio An attacker can include any arbitrary text using specially crafted udemy url. Reporting this but not sure if this is in scope text injection not marked in exclusion list Kindly mark it as informative in case if it is out of scope Issue seems to be because of sourcepage=clp param. If this...

Khan Academy: The web app's forgot password page is vulnerable to text injection/content spoofing

An attacker will exploit this by chaining it with CSRF there is not protection against CSRF for that page as scenario can only be created by a POST request. The attacker will target innocent users by doing this and some of them would fall in trap by calling the number or by sending the email. Mor...

FreeBSD : moodle -- multiple vulnerabilities (3ddcb42b-5b78-11e6-b334-002590263bf5)

Marina Glancy reports : - MSA-16-0019: Glossary search displays entries without checking user permissions to view them - MSA-16-0020: Text injection in email headers - MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course %NASLMINLEVE...

Phabricator: Error page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

moodle -- multiple vulnerabilities

Marina Glancy reports: MSA-16-0019: Glossary search displays entries without checking user permissions to view them MSA-16-0020: Text injection in email headers MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course...