joueb.com Cross Site Scripting vulnerability OBB-2240519

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-39412

CVE-2021-39412 affects PHPGurukul Shopping v3.1, with multiple XSS vulnerabilities exposed via three vectors in server_side/scripts/id_jsonp.php, server_side/scripts/jsonp.php, and scripts/objects_jsonp.php (callback parameter); an additional vector in examples_support/editable_ajax.php (value pa...

TIWAP - Totally Insecure Web Application Project

TIWAP is a web security testing lab made using Flask for budding security enthusiasts to learn about various web vulnerabilities. Inspired by DVWA, the contributors have tried their best to regenerate various web vulnerabilities The application is solely made for educational purpose and to learn...

CVE-2021-38491

Mozilla Firefox before version 92 is affected by CVE-2021-38491: mixed-content checks fail to analyze opaque origins, allowing some mixed content to load. The issue is documented across multiple sources (e.g., Mozilla MFSA advisory and distro advisories) and is fixed/upstream mitigated by upgradi...

CVE-2020-12814

CVE-2020-12814 is a cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer prior to certain versions (6.0.6 and 6.4.4 or earlier as described) caused by improper neutralization of input during web page generation in the web GUI. An attacker could craft requests to the FortiAnalyzer we...

fmidr.com Cross Site Scripting vulnerability OBB-2226437

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2021-6873

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA affected versions not specified Description A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to...

PT-2021-6796

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance versions affected versions not specified Description The issue is related to the Web-Based Reputation Score WBRS engine of Cisco AsyncOS Software, which is affected by insufficient input validation. This could allo...

PT-2021-6795

Name of the Vulnerable Software and Affected Versions Cisco Email Security Appliance ESA affected versions not specified Cisco Web Security Appliance WSA affected versions not specified Cisco Secure Email and Web Manager affected versions not specified Description A vulnerability in the TCP/IP...

murderinkproductions.com Improper Access Control vulnerability OBB-2220368

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

eurolab.ua Cross Site Scripting vulnerability OBB-2220279

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Coming Soon, Under Construction...

Cross-site Scripting (XSS)

Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Cross-site Scripting XSS by using the index.php?s=order&ids="alert1; payload. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script...

CVE-2021-35237

A missing HTTP header X-Frame-Options in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server...

PortSwigger Web Security: Information disclosure on error message

Hai team, First of all , Thank you creating a wonderful place for learning web app pentesting : . In accessing a lab at the academy , my internet connection suddenly went down, I dont know the problem is on the lab or in academy, But the error message reveals some node codes.I attached a screensh...

GHSA-97X5-CC53-CV4V Cross site scripting in froala-editor

A cross site scripting XSS vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML...

Recent NPM package hack is an alarming reminder of the risks of website supply-chain fraud

There are over 1.8 billion websites online today. Almost 98% of them are powered by JavaScript, and for a good reason: JavaScript’s flexibility and portability enable the rich online functionality we’ve all come to know and love. But when that same functionality becomes a significant vector for...

explorebabynames.com Cross Site Scripting vulnerability OBB-2206086

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Session Fixation in kasuganosoras/pigeon

✍️ Description Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application. When authenticating a user, it doesn't assign a new sessio...

webagency.expert Improper Access Control vulnerability OBB-2201484

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...