direktbestellen.de Improper Access Control vulnerability OBB-3773448

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the Check Email function in the OpenCATS workforce management system allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Check Email function in the OpenCATS workforce management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using the email parameter...

saomigueldoiguacu.pr.leg.br Cross Site Scripting vulnerability OBB-3772097

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEBIAN-CVE-2023-5824

A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk...

CVE-2023-45202

CVE-2023-45202 affects Online Examination System v1.0. The issue is multiple Open Redirects in the feed.php resource’s q parameter, enabling an attacker to redirect a victim to an arbitrary website via a crafted URL. Exploitation details are not provided in the sources. The Red Hat and PRION entr...

Cross-site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Cross-site Scripting XSS. An attacker could exploit this vulnerability by tricking a user into clicking on a malicious link or a file via the file attachment upload functionality, which would contain a specially crafted XSS payload that would be injected into th...

CVE-2023-5516

CVE-2023-5516 is associated with Hitachi Energy eSOMS. The EU/ICS and CVE entries describe a vulnerability where poorly constructed web requests and URI components disclose sensitive information (internal paths, endpoints, server details) via web responses. Affected product: eSOMS (v6.3.13 and pr...

CVE-2023-5515

The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the application and to further plot attacks against web servers and deployed web applications...

CVE-2023-47099

CVE-2023-47099 is a stored XSS in Virtualmin’s Create Virtual Server feature affecting Virtualmin 7.7. The vulnerability stems from insufficient sanitization of the Description field during Virtual Server creation, allowing remote attackers to inject arbitrary script/HTML. Impact is XSS in the se...

CVE-2023-47094

CVE-2023-47094 is a Stored Cross-Site Scripting (XSS) vulnerability in Virtualmin 7.7, affecting the Account Plans tab in System Settings. The issue allows remote attackers to inject arbitrary web script/HTML through the Plan name field while editing Account plan details. The available documents ...

CVE-2019-25155

DOMPurify before 1.0.11 is affected by a reverse tabnabbing issue in demos/hooks-target-blank-demo.html due to missing rel="noopener noreferrer" on links. This is the concrete vulnerability described across CVE-2019-25155 entries: the root cause is the absence of a security attribute on target-bl...

Mozilla: Address bar spoofing via bidirectional characters

The Mozilla Foundation Security Advisory describes this flaw as: An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited...

Mozilla: Queued up rendering could have allowed websites to clickjack

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: Certain browser prompts and dialogs could be activated or dismissed unintentionally by the user due to an insufficient activation delay...

waukondental.com Cross Site Scripting vulnerability OBB-3769202

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-4964

CVE-2023-4964 : OpenText SMAX and AMX are affected by an open redirect vulnerability. Affected SMAX versions: 2020.05, 2020.08, 2020.11, 2021.02, 2021.05, 2021.08, 2021.11, 2022.05, 2022.11; affected AMX versions: 2021.08, 2021.11, 2022.05, 2022.11. Root cause and exact exploitation details are n...

dukhrana.com Cross Site Scripting vulnerability OBB-3768929

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

pixopolis-web.de Improper Access Control vulnerability OBB-3768676

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kosmetik-kamee.de Improper Access Control vulnerability OBB-3768432

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

dentalwaren.de Improper Access Control vulnerability OBB-3768186

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the web page rendering modules in Safari’s WebKit browser for iOS, watchOS, tvOS, iPadOS operating systems allows attackers to execute arbitrary code.

The vulnerability of the Web page rendering modules in WebKit of Safari browsers for iOS, watchOS, tvOS, and iPadOS systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...