Kudos Donations < 3.1.2 - Arbitrary Items Deletion via CSRF

The plugin has a logic flaw in its CSRF checks when deleting items such as Donors, Transactions, Subscriptions etc, allowing attackers to make a logged in admin delete them PoC https://example.com/wp-admin/admin.php?page=kudos-transactions=delete=1...

webmailer.evanto.de Cross Site Scripting vulnerability OBB-2275903

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

webparallevar.com Improper Access Control vulnerability OBB-2268536

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Twill 跨站请求伪造漏洞

Twill is an open source Cms toolkit for Laravel. It is used to help developers quickly create intuitive, powerful and flexible custom management console. twill cross-site request forgery vulnerability, the vulnerability stems from the software in the login authentication process using get request...

The vulnerability of the Cisco AsyncOS operating system proxy server of Cisco Web Security Appliance allows a perpetrator to cause a service failure or execute arbitrary code.

The vulnerability of the Cisco AsyncOS operating system’s proxy server, which is part of the Cisco Web Security Appliance internet gateway, relates to memory release errors. Exploiting this vulnerability could allow a malicious actor to cause service failures or execute arbitrary code...

Employee Daily Task Management System 1.0 Cross Site Scripting

Exploit Title: Employee Daily Task Management System 1.0 - 'Name' Stored Cross-Site Scripting XSS Date: 09/11/2021 Exploit Author: Ragavender A G Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/edtms.zip Version...

webkitgtk: Use-after-free in ImageLoader dispatchPendingErrorEvent leading to information leak and possibly code execution

A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked in...

CVE-2021-29735

CVE-2021-29735 affects IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3. The vulnerability is a cross-site scripting flaw in the Web UI that allows embedding arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a trusted session. The ro...

Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack

Description Attacker is able to logout a user if a logged in user visits attacker website. Impact This vulnerability is capable of forging user to unintentional logout. Test Tested on Edge, firefox, chrome and safari. Fix You should use POST instead of GET. To expand: One way GET could be abused...

BEESCMS 代码问题漏洞

BEESCMS is a template program completely separated, using PHP MYSQL technology development, with powerful SEO features, simple operation of the self-service building system. BEESCMS version 4.0 /admin/upload.php in the arbitrary file upload vulnerability. The vulnerability can be exploited by...

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Description Attacker is able to logout a user if a logged in user visits attacker website. Impact This vulnerability is capable of forging user to unintentional logout. Test Tested on Edge, firefox, chrome and safari. Fix You should use POST instead of GET. To expand: One way GET could be abused...

joueb.com Cross Site Scripting vulnerability OBB-2240519

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-39412

CVE-2021-39412 affects PHPGurukul Shopping v3.1, with multiple XSS vulnerabilities exposed via three vectors in server_side/scripts/id_jsonp.php, server_side/scripts/jsonp.php, and scripts/objects_jsonp.php (callback parameter); an additional vector in examples_support/editable_ajax.php (value pa...

TIWAP - Totally Insecure Web Application Project

TIWAP is a web security testing lab made using Flask for budding security enthusiasts to learn about various web vulnerabilities. Inspired by DVWA, the contributors have tried their best to regenerate various web vulnerabilities The application is solely made for educational purpose and to learn...

CVE-2021-38491

Mozilla Firefox before version 92 is affected by CVE-2021-38491: mixed-content checks fail to analyze opaque origins, allowing some mixed content to load. The issue is documented across multiple sources (e.g., Mozilla MFSA advisory and distro advisories) and is fixed/upstream mitigated by upgradi...

CVE-2020-12814

CVE-2020-12814 is a cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer prior to certain versions (6.0.6 and 6.4.4 or earlier as described) caused by improper neutralization of input during web page generation in the web GUI. An attacker could craft requests to the FortiAnalyzer we...

fmidr.com Cross Site Scripting vulnerability OBB-2226437

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

murderinkproductions.com Improper Access Control vulnerability OBB-2220368

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

eurolab.ua Cross Site Scripting vulnerability OBB-2220279

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Coming Soon, Under Construction...