Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account

Apple recently paid Indian vulnerability researcher Bhavuk Jain a huge $100,000 bug bounty for reporting a highly critical vulnerability affecting its 'Sign in with Apple ' system. The now-patched vulnerability could have allowed remote attackers to bypass authentication and take over targeted...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2020-31089)

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS Made...

Cross-site scripting vulnerability in WebKit component of multiple Apple products (CNVD-2020-43687)

Apple iOS is an operating system developed for mobile devices.Apple tvOS is an operating system for smart TVs.Apple iPadOS is an operating system for iPad tablets.WebKit is one of the web browser engine components. A cross-site scripting vulnerability exists in the WebKit component of several App...

Fork CMS Cross-Site Scripting Vulnerability (CNVD-2020-31119)

Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A cross-site scripting vulnerability exists in Fork versions prior to 5.8.3. The vulnerability stems from the lack of proper validation of...

Cross-site scripting vulnerability in WebKit component of multiple Apple products (CNVD-2020-43686)

Apple iOS is an operating system developed for mobile devices.Apple tvOS is an operating system for smart TVs.Apple iPadOS is an operating system for iPad tablets.WebKit is one of the web browser engine components. A cross-site scripting vulnerability exists in the WebKit component of several App...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: User Email Verification Bypass OAuth Flow Missing Email Verification Checks Notification Email Verification Bypass Undisclosed Vulnerability on a Third-Party Rendering Engine Group Sign-Up Restriction Bypass Mirror Project Owner Impersonation Missing Permission Check on Fork...

httpd: mod_rewrite potential open redirect

A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers...

Grafana Cross-Site Scripting Vulnerability (CNVD-2020-31669)

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. Grafana suffers from a cross-site scripting vulnerability. The vulnerability stems fro...

ocProducts Composr CMS Cross-Site Scripting Vulnerability

ocProducts Composr CMS is the UK ocProducts company's set of open source content management system CMS written in PHP language . A cross-site scripting vulnerability exists in ocProducts Composr CMS version 10.0.30. The vulnerability stems from a lack of proper validation of client-side data by t...

PCS DEXICON Cross-Site Scripting Vulnerability

PCS DEXICON is a solution for time recording and access control. A cross-site scripting vulnerability exists in the 'loginName' parameter in the loginaction.jsp file in PCS DEXICON version 3.4.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. ...

jQuery cross-site scripting vulnerability (CNVD-2021-28270)

jQuery is the United States John Resig programmer of a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in versions of...

CVE-2020-8434

Jenzabar JICS aka Internet Campus Solution before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ...

Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2020-33669)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...

Open edX cross-site scripting vulnerability (CNVD-2020-33666)

Open edX is an online learning management system from edX Corporation in the United States. A cross-site scripting vulnerability exists in Studio in Open edX Ironwood version 2.5, which stems from the lack of proper validation of client-side data in the WEB application and can be exploited by an...

MISP Cross-Site Scripting Vulnerability (CNVD-2021-08165)

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in the app/View/Events/resolvedattributes.ctp...

Submitty Cross-Site Scripting Vulnerability

Submitty is an open source course management system . The system supports course management , assignment submission , exams and grading system and other functions . A cross-site scripting vulnerability exists in Submitty 20.04.01 and earlier versions , the vulnerability stems from the lack of...

Estsoft ALSong Cross-Site Scripting Vulnerability

Eastsoft ALSong is a music player from the Korean company Eastsoft. A cross-site scripting vulnerability exists in Eastsoft ALSong 3.46 and earlier versions, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

Teclib GLPI Cross-Site Scripting Vulnerability (CNVD-2020-29626)

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in Teclib GLPI. The vulnerabilit...

SUSE openSUSE Cross-Site Scripting Vulnerability

openSUSE is a set of Linux-based free operating system and open source community project of the German SUSE company. A cross-site scripting vulnerability exists in previous versions of SUSE openSUSE open-build-service 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb. The vulnerability stems from a lack o...

Nextcloud Server Cross-Site Scripting Vulnerability (CNVD-2021-28008)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A cross-site scripting vulnerability exists in the Files PDF viewer in Nextcloud Server versions prior to 18.0.3. The vulnerability stems from a lack of prope...