CVE-2022-35653

Moodle LTI module Reflected Cross-Site Scripting (CVE-2022-35653) stems from insufficient sanitization of user-supplied data. A remote attacker can lure a user into opening a crafted link and execute arbitrary HTML/JavaScript in the victim’s browser, potentially stealing data or altering the page...

CVE-2022-35651

CVE-2022-35651 describes a vulnerability in Moodle where insufficient sanitization of user-supplied data in SCORM track details enables a stored XSS and blind SSRF. A remote attacker can lure a user to follow a crafted link and execute arbitrary HTML/script in the context of the vulnerable site, ...

vynckier.nl Cross Site Scripting vulnerability OBB-2813789

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

webservices.icodes.co.uk Cross Site Scripting vulnerability OBB-2813775

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

llhttp: HTTP Request Smuggling when parsing the body of chunked requests

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...

CVE-2022-34025

Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...

CVE-2022-36305

Affected software: Vesta Control Panel (VestaCP) version v1.0.0-5. The issue is a cross-site scripting (XSS) vulnerability in the body function of UploadHandler.php (path: /web/api/v1/upload/UploadHandler.php). Root cause: improper handling of input in the UploadHandler, enabling XSS. Impact: pot...

CVE-2021-32504

The CVE-2021-32504 entry maps to the SICK FTMg device vulnerability. Unauthenticated users can access sensitive web URLs via GET, which should be restricted to maintenance users only. The underlying issue is a lack of proper access control for web resources, enabling an attacker to retrieve sensi...

CVE-2022-29057

Fortinet FortiEDR CVE-2022-29057 is a reflected cross-site scripting (XSS) vulnerability arising from improper input neutralization during web page generation in the FortiEDR Management Console. A remote authenticated attacker can exploit this via various endpoints to inject malicious payloads. A...

CVE-2022-30620

The CVE-2022-30620 entry concerns Cellinx Camera (guest-enabled) where an attacker with web access can elevate from guest to administrative privileges by modifying cookie values (notably is_admin and showConfig), enabling changes to camera configuration. Connected sources corroborate privilege es...

botamici.it Cross Site Scripting vulnerability OBB-2792397

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bahnbilder.de Cross Site Scripting vulnerability OBB-2792025

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-31208

Infiray IRAY-A8Z3 1.0.957 webserver is affected by CVE-2022-31208: an endpoint can execute arbitrary commands via the cmd_string URL parameter. Root cause described as improper handling of cmd_string leading to command execution. The vulnerability supports network access with low privileges and n...

zhaobannet.com Cross Site Scripting vulnerability OBB-2785868

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

placeweb.site Cross Site Scripting vulnerability OBB-2785288

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

brigittebox.de Cross Site Scripting vulnerability OBB-2784465

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

artofmusic.nl Cross Site Scripting vulnerability OBB-2780159

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

URVE Web Manager 代码问题漏洞

URVE Web Manager is a website manager from URVE. A security vulnerability exists in URVE Web Manager that can be exploited by attackers to upload files without restriction...

URVE Web Manager 代码问题漏洞

URVE Web Manager is a website manager from URVE. A security vulnerability exists in URVE Web Manager that can be exploited by attackers to upload files without restriction...

phylotaxis.com Cross Site Scripting vulnerability OBB-2772017

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...