Mozilla Firefox < 109.0

The version of Firefox installed on the remote Windows host is prior to 109.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-01 advisory. - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs...

U.S. Dept Of Defense: Reflected XSS at ████████

A reflected cross-site scripting XSS vulnerability was discovered in the dochelper feature of a certain domain. An attacker could inject a crafted script into the userId parameter, which would execute when the victim user accessed the page, potentially allowing the attacker to steal the victim's...

iam.fiocruz.br Cross Site Scripting vulnerability OBB-3147784

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-45729

A cross-site scripting XSS vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Employee ID parameter...

Path Traversal - Archiving Files to Zip

Description The Tiny File Manager pack files feature is vulnerable to path traversal, which allows an attacker to access files that reside outside the web document root directory. The vulnerability occurs as the "file" parameter is not sanitized properly, thus allowing a malicious user to input...

UBUNTU-CVE-2022-39183

Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors...

bozemanmagazine.com Cross Site Scripting vulnerability OBB-3142694

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via manipulation of the argument filename in the placeholder function. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise...

autoparts.beforward.jp Cross Site Scripting vulnerability OBB-3131930

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for SQL Injection in Reputeinfosystems Bookingpress

CVE-2022-0739 My take on CVE-2022-0739 BookingPress exploit,...

CVE-2022-44870

The CVE-2022-44870 issue is a reflected XSS in maccms10 v2022.1000.3032. The vulnerability is triggered by a crafted payload injected into the Name parameter in the AD Management module, enabling an attacker to execute arbitrary web scripts or HTML in the user’s browser. Documented impact is limi...

bureau-mania.com Cross Site Scripting vulnerability OBB-3129496

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-3614

CVE-2022-3614 affects Octopus Deploy. The vulnerability enables users authenticating via AD in certain browsers to bypass authentication checks during sign-in and be redirected to the configured redirect URL without validation, effectively leaking session/auth context through an unchecked redirec...

web.burnettcounty.org Cross Site Scripting vulnerability OBB-3126911

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Delete any post for all users via IDOR

Description Delete any post for all users via IDOR Proof of Concept 1- Post anything 2- Open Burp Suite to intercept the request 3- When deleting the post, we will notice that there is DELETE /api/memo/1010 in the request, Here the post id will be 1010 4- This number can be changed and any post y...

Rdiffweb 跨站请求伪造漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A cross-site request forgery vulnerability exists in rdiffweb versions prior to 2.5.4. An attacker can exploit this vulnerability to...

CVE-2022-28281

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to an out-of-bounds write caused by a boundary error when processing an unexpected number of WebAuthN Extensions in a Register command . A compromised content process can trigger this memory corruption, potentially leading to a crash ...

CVE-2022-28284

SVG's use element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with...

CVE-2022-42362

CVE-2022-42362 concerns Adobe Experience Manager (AEM) 6.5.14 and earlier, with a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who lure a user to a crafted URL can cause malicious JavaScript to run in the victim’s browser context. The available connected documents confirm the a...

Unsanitized input returned in response is conducive to XSS exploitation

Description During the initial installation process it was identified that the "Create user" form that collects user data, does not properly sanitize the data entry and then prints them on the screen with an error message without any apparent validation, thus allowing the insertion of HTML or...