Directory traversal

node-server-forfront is a simple static file server. node-server-forfront is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url...

Moodle Design Vulnerability (CNVD-2018-10647)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in the Moodle 3.x version. By replacing the URL in the...

Directory Traversal

html-pages is vulnerable to directory traversal attacks. A malicious user can obtain access to files on the system by prepending ../ in the url or curl request such as $ curl -v --path-as-is http://127.0.0.1:8000/../../../../../etc/passwd...

CVE-2018-1134

An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL...

CVE-2018-1135

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...

UBUNTU-CVE-2018-1135

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...

banana-games.tops.bg XSS vulnerability

Open Bug Bounty ID: OBB-617649 Description| Value ---|--- Affected Website:| banana-games.tops.bg Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-10561

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diagFORM?images/ URI. One can then manage the device...

fonaper.com.br XSS vulnerability

Open Bug Bounty ID: OBB-603232 Description| Value ---|--- Affected Website:| fonaper.com.br Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-3965

The CVE-2017-3965 entry concerns the McAfee Network Security Management (NSM) web interface. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in NSM prior to 8.2.7.42.2 that enables remote attackers to perform unauthorized tasks by issuing specially crafted URLs. The affected compone...

Grav CMS 1.2.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications CVE-2018-5233 Grav CMS admin plugin Reflected Cross Site Scripting XSS vulnerability Description Grav CMS is a flat-file CMS using Markdown files for content management Official Website. It has been elected "Best Open Source CMS of 2016" by CM...

mail.hp.gov.cn Open Redirect vulnerability

Open Bug Bounty ID: OBB-576430 Description| Value ---|--- Affected Website:| mail.hp.gov.cn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Directory Traversal

localhost-now is vulnerable to directory traversal attacks. These attacks are possible by requesting a url such as ../../confidential.txt to get sensitive information...

CVE-2018-7032

CVE-2018-7032 affects the myrepos package, specifically the webcheckout component used when cloning via git. The issue is that URLs passed to git clone are not sanitized, enabling a remote attacker or MitM to craft a URL that could lead to arbitrary code execution (e.g., via an ext::sh -c attack ...

priestory.inzercia.sk XSS vulnerability

Open Bug Bounty ID: OBB-551509 Description| Value ---|--- Affected Website:| priestory.inzercia.sk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

getsalt.com XSS vulnerability

Open Bug Bounty ID: OBB-531367 Description| Value ---|--- Affected Website:| getsalt.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Showmax: Query string parameter modifications returned in page

NOTE BEFOREHAND: I KNOW it's not located on the core showmax.com domain, but that doesn't effect the applications of this and it still has the same risk. Summary: At https://sso.showmax.com/auth/failure?message=, you can change the message parameter to any text and it will be returned on the page...

CVE-2017-15714

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "format=%27;alert%27xss%27" to the URL an alert window would execute...

udaf70.fr XSS vulnerability

Open Bug Bounty ID: OBB-459180 Description| Value ---|--- Affected Website:| udaf70.fr Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

censtatd.gov.hk XSS vulnerability

Open Bug Bounty ID: OBB-449151 Description| Value ---|--- Affected Website:| censtatd.gov.hk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...