Cross-site Scripting (XSS) - Reflected in microweber/microweber

Description XSS - Cross-Site Scripting is vulnerability which allows attackers to execute arbitrary javascript code in the browser of victim. PAYLOAD for firefox: a' onafterscriptexecute=alertdocument.domain c='a requires NO user-interaction PAYLOAD for all major browsers: a'...

webmail.mbpha.gov.pg Cross Site Scripting vulnerability OBB-2319912

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

j-n.co.jp Cross Site Scripting vulnerability OBB-2318329

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

st-johann-erding.de Cross Site Scripting vulnerability OBB-2315799

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-Site Request Forgery (CSRF) in thorsten/phpmyfaq

Description Hi there phpmyfaq team, I would like to report a Cross site request Forgery in phpmyfaq. It is in publishing question. Cross-site request forgery also known as CSRF is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to...

krassa.cz Cross Site Scripting vulnerability OBB-2310994

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-Site Request Forgery (CSRF) in yourls/yourls

Description 1. Hi there YOURLS team, I would like to report a Cross Site Request forgery vulenrability on YOURLS. Cross-site request forgery also known as CSRF is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform. It allows ...

MTN Group: Information disclosure through django debug mode

Summary: Your domain https://szezvzorilla.mtn.co.sz was disclosing information throught django debug mode enable. Steps To Reproduce: Visit https://szezvzorilla.mtn.co.sz/NONEXISTINGPATH/ You will the information of debugging Supporting Material/References: F1555934 attachment / reference Impact...

CVE-2021-43630

Projectworlds Hospital Management System v1.0 is affected by an SQL injection in add_patient.php across multiple parameters. The root cause is improper input handling allowing an authenticated attacker to manipulate queries, potentially compromising the database and, in some cases, achieving remo...

PT-2021-24198 · Mozilla +4 · Pdf.Js +4

Name of the Vulnerable Software and Affected Versions: GNOME Web aka Epiphany versions prior to 40.4 GNOME Web aka Epiphany versions 41.x prior to 41.1 Description: A security issue exists due to the use of a server's suggested filename as the pdf name value in PDF.js, leading to potential XSS...

Arunna 1.0.0 Cross Site Request Forgery

Exploit Title: Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery CSRF Date: November 29, 2021 Exploit Author: =LL= Detailed Bug Description: https://lyhinslab.org/index.php/2021/11/29/how-white-box-hacking-works-xss-csrf-in-arunna/ Vendor Homepage: https://github.com/arunna Software Link:...

CVE-2020-18984

CVE-2020-18984 describes a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration 8.8.12, specifically in the zimbraAdmin/public/secureRequest.jsp component. The issue allows unauthenticated attackers to execute arbitrary web scripts or HTML through host header injection. The ...

pikachu

It is an offensive tool for web application security training. The primary CVE ID is not explicitly mentioned, but the tool is designed to demonstrate various web security vulnerabilities, including Burt Force, XSS, CSRF, SQL-Inject, RCE, Files Inclusion, Unsafe file downloads, Unsafe file upload...

Vulnerability fixed in Cisco Web Security Appliance

A vulnerability has been fixed in Cisco Web Security Appliance. The vulnerability allows an unauthenticated remote malicious person to remotely capable of causing a denial-of-service. The Cisco Web Security Appliance can crash due to a large number of HTTP requests, manual actions may be necessar...

Judge.me : Error Page Content Spoofing or Text Injection

Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply conten...

CVE-2021-41029

Fortinet FortiWLM 8.6.1 and earlier versions are affected by a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. An authenticated attacker can store malicious JavaScript on the device and trigger it via crafted HTTP requests or ...

Is your web browser vulnerable to data theft? XS-Leak explained

In recent news, IT security researchers from Ruhr-Universität Bochum RUB and the Niederrhein University of Applied Sciences have disclosed 14 new cross-site leak also known as XSLeak or XS-Leak attacks that can affects modern browsers, such as Google Chrome, Microsoft Edge, Mozilla Firefox, and...

kariera.travelist.pl Cross Site Scripting vulnerability OBB-2294833

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

firefly-iii 跨站请求伪造漏洞

firefly-iii is a free open source personal finance manager. A cross-site request forgery vulnerability exists in firefly-ii, which can be exploited by attackers to launch cross-site request forgery CSRF attacks...

CVE-2021-35415

Chamilo LMS is affected by a stored XSS vulnerability (CVE-2021-35415) where a crafted payload in the course “Title” and “Content” fields can execute arbitrary web scripts/HTML. The issue is described across multiple sources, tying it to unsanitized input in these fields. The available records do...