paarden-vakantie-waddeneilanden.klikklik.nl Cross Site Scripting vulnerability OBB-2379752

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-site Scripting (XSS) - Stored

Description Stored XSS is a vulnerability in which the attacker can execute arbitrary javascript code in the victim's browser. The XSS payload is stored in a webpage and it gets executed whenever someone visits that webpage. I used &10 Line Feed character in the href attribute of tag to bypass th...

emploi-plombier.com Cross Site Scripting vulnerability OBB-2377525

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Fortinet Fortimail 7.0.1 Cross Site Scripting

Exploit Title: Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/fmlurlsvc/ Date: 01-Feb-2022 Exploit Author: Braiant Giraldo Villa Contact: @ironfortress Twitter Vendor Homepage: https://www.fortinet.com/products/email-security Software Link:...

ZEROF Web Server SQL注入漏洞

ZEROF Web Server is an open source Web framework that simplifies modern Web development . It allows you to build applications without having to worry about package management or routing. ZEROF Web Server has a SQL injection vulnerability that allows HandleEvent SQL injection...

CVE-2014-8597

CVE-2014-8597 describes a reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07. The issue allows remote attackers to inject arbitrary web script or HTML via the status parameter in the CMS admin panel. Documents in the connected set corroborate the vulnerability as a reflected...

Cross-site Scripting (XSS) - Generic

Description The user-controlled GET user parameter in index.php is unsanitized resulting in Cross-Site Scripting. Proof of Concept Endpoint: GET https://HOST/edit/user File: /web/edit/user/index.phpL11 // Check user argument if empty$GET'user' header"Location: /list/user/"; exit; Request...

aniseeventcatering.com.au Cross Site Scripting vulnerability OBB-2375516

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-24985

The CVE-2022-24985 issue concerns JQueryForm.com Form Builder. Affected component: forms generated by JQueryForm.com prior to 2022-02-05. Root cause: an authentication bypass allowing a remote authenticated attacker to access the administrative section of other forms hosted on the same web server...

digitalsimplex.com Cross Site Scripting vulnerability OBB-2374753

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Is Firefox OK?

Mozilla’s privacy-heavy browser is flatlining. What it does next is crucial for the future of the web...

ruby: Cookie prefix spoofing in CGI::Cookie.parse

A flaw was found in Ruby. RubyGems cgi gem could allow a remote attacker to conduct spoofing attacks caused by the mishandling of security prefixes in cookie names in the CGI::Cookie.parse function. By sending a specially-crafted request, an attacker could perform cookie prefix spoofing attacks...

dangerthings.submissive-girl.com Cross Site Scripting vulnerability OBB-2373902

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-24589

CVE-2022-24589 concerns Burden v3.0, where a stored cross-site scripting (XSS) flaw exists in the Add Category function. A crafted payload in the task parameter allows execution of arbitrary web scripts or HTML. This is the stated vulnerability, with multiple vendor/NVD entries confirming the sam...

OS Command Injection in part-db/part-db

Description OS command injection also known as shell injection is a web security vulnerability that allows an attacker to execute arbitrary operating system OS commands on the server that is running an application, and typically fully compromise the application and all its data. Very often, an...

Mozilla: Sandboxed iframes could have executed script if the parent appended elements

The Mozilla Foundation Security Advisory describes this flaw as: If a document created a sandboxed iframe without allow-scripts and subsequently appended an element to the iframe's document that, for example, had a JavaScript event handler - the event handler would have run despite the iframe's...

CVE-2021-46558

CVE-2021-46558 concerns Issabel PBX 20200102 with multiple XSS vulnerabilities in the Add User module. The flaws allow an attacker to inject arbitrary web scripts or HTML through crafted payloads in the username and password fields, enabling client-side script execution. Documented impact is limi...

CVE-2022-24227

BoltWire exposes a documented XSS vulnerability (CVE-2022-24227) affecting v7.10 and v8.00 where an attacker can inject arbitrary scripts/HTML via crafted input in the name and lastname fields. The Red Hat/PRION/CNNVD entries corroborate the same issue. Remediation guidance from PT-2022-16547 rec...

Adobe: Zero-Day Magento 2 RCE Bug Under Active Attack

A zero-day remote code-execution RCE bug in the Magento 2 and Adobe Commerce platforms has been actively exploited in the wild, Adobe said – prompting an emergency patch to roll out over the weekend. The security vulnerability bug CVE-2022-24086 is a critical affair, allowing pre-authentication R...

Adobe patches actively exploited Magento/Adobe Commerce zero-day

Adobe has released an emergency advisory for users of its Commerce and Magento platforms. It explains that a critical zero-day vulnerability is actively being exploited in attacks against sites that use these two content management system CMSs. Users should apply the patch as soon as possible. Th...