16297 matches found
PT-2022-13700
Name of the Vulnerable Software and Affected Versions Be POPIA Compliant versions up to and including 1.1.5 Description The issue exposes sensitive information, including site visitors' emails and usernames, to unauthenticated users through an API route. Recommendations For versions up to and...
CVE-2022-26653
Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details such as the username and GUID of an administrator...
Zoho ManageEngine Remote Access Plus security vulnerabilities
Zoho ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A security vulnerability exists in Zoho ManageEngine Remote Access Plus, which could be exploited by an attacker to allow guest users to view domain details such as the administrator's username and GUID...
Delta Controls enteliTOUCH 3.40.3935 Cross Site Scripting Vulnerability
enteliTouch XSS alertdocument.cookie" / input type="hidden" n...
Delta Controls enteliTOUCH 3.40.3935 Cross Site Scripting
enteliTouch XSS alertdocument.cookie" /...
CVE-2022-1347
Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation...
CVE-2022-1347 Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr
Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation...
CVE-2022-1347 Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr
Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation...
Organizr cross-site scripting vulnerabilities
Organizr is a tab management system. Organizr 2.1.1810 prior versions of cross-site scripting vulnerability, the vulnerability stems from the Username and Email fields lack of data provided by the user and the output data validation filter, an attacker can use the vulnerability in the client to...
PT-2022-13817
Name of the Vulnerable Software and Affected Versions causefx/organizr versions prior to 2.1.1810 Description The issue is related to Stored XSS in the Username and Email input fields, which can lead to account takeover of Admin and Co-admin users. This results in account takeover and privilege...
CVE-2022-1347: Improper Neutralization of Input During Web Page Generation
Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation...
GoCD injection vulnerability
GoCd is a continuous delivery server. GoCD suffers from an injection vulnerability that stems from the fact that the gocd-ldap-authentication-plugin included in GoCD Server fails to properly escape special characters when constructing an LDAP query using a username. An attacker could use this...
SAM SUNNY TRIPOWER 5.0 Insecure Direct Object Reference
Exploit Title: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference IDOR Date: 7/4/2022 Exploit Author: Momen Eldawakhly Cyber Guy Vendor Homepage: https://www.sma.de Version: SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R Tested on: Linux Firefox CVE : CVE-2021-46416 Proof of Concept...
Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users
Description The application Organizr allows malicious javascript in the "Username" & "Email" input fields for which an attacker can able to take over the account of Admin & Co-admin users. Proof of Concept 1.During "Signup" put the below payloads in the "Username" & "Email" input fields. 2.Now ru...
CVE-2022-28363
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability XSS in the /goform/loginprocess username parameter via GET. No authentication is required...
CVE-2022-28363: Improper Neutralization of Input During Web Page Generation
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability XSS in the /goform/loginprocess username parameter via GET. No authentication is required...
Rumble Mail Server Cross-Site Scripting Vulnerability
Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3 and IMAP4v1 by Daniel Gruno, a personal developer.A cross-site scripting vulnerability exists in Rumble Mail Server version 0.51.3135, which stems from the username parameter's lack of data validation filtering for user The...
Ecommerce-Website Cross-Site Scripting Vulnerability
Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. version v1.1.0 of Ecommerce-Website contains a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary Web script or HTML by injecting a payload into the...