EUVD-2013-4368

Malware in sbrugna...

EUVD-2022-25101

Malicious code in bioql PyPI...

CVE-2022-1825

Cross-site Scripting XSS - Reflected in GitHub repository collectiveaccess/providence prior to 1.8...

CVE-2013-4507

Cross-site scripting XSS vulnerability in CollectiveAccess Providence and Pawtucket before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

WS-2023-0210

Partial Local file inclusion in GitHub repository collectiveaccess/providence through 1.8rc1...

CVE-2022-1825

Cross-site Scripting XSS - Reflected in GitHub repository collectiveaccess/providence prior to 1.8...

CVE-2022-1825

Cross-site Scripting XSS - Reflected in GitHub repository collectiveaccess/providence prior to 1.8...

CVE-2022-1825 Cross-site Scripting (XSS) - Reflected in collectiveaccess/providence

Cross-site Scripting XSS - Reflected in GitHub repository collectiveaccess/providence prior to 1.8...

CVE-2022-1825

CVE-2022-1825: Reflected XSS in Providence (CollectiveAccess) before version 1.8. Exploitation occurs via reflected user input; impact is limited to confidentiality/integrity with MEDIUM severity (CVSS 3.1: 5.4). No explicit exploit details provided in the supplied documents. Affected product is ...

CVE-2022-1825

Cross-site Scripting XSS - Reflected in GitHub repository collectiveaccess/providence prior to 1.8...

CVE-2022-1825 Cross-site Scripting (XSS) - Reflected in collectiveaccess/providence

Cross-site Scripting XSS - Reflected in GitHub repository collectiveaccess/providence prior to 1.8...

CVE-2022-1825: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Reflected in GitHub repository collectiveaccess/providence prior to 1.8...

PT-2022-14144

Name of the Vulnerable Software and Affected Versions collectiveaccess/providence versions prior to 1.8 Description The issue is related to Cross-site Scripting XSS - Reflected. This means an attacker can inject malicious scripts into a website, which will be executed by the user's browser. No...

Providence 跨站脚本漏洞

Providence is the "back-end" component of CollectiveAccess, a set of web-based applications from the CollectiveAccess community in the United States. A security vulnerability exists in Providence versions prior to 1.8, which stems from a cross-site scripting vulnerability...

Open Redirect in collectiveaccess/providence

Description I found a new way to bypass the Open Redirect with the "redirect" parameter on the login page. Vulnerable parameter redirect Payload https://demo.collectiveaccess.org.example.com Proof of Concept Send users the following login link...

Improper Authorization in collectiveaccess/pawtucket2

Description Users without any readaccess to a lightbox can still view its contents via incrementing the id Proof of Concept ... http://10.0.2.15/pawtucket/index.php/Lightbox/Present/setid/1 http://10.0.2.15/pawtucket/index.php/Lightbox/Present/setid/2...

in collectiveaccess/pawtucket2

Description With ref to this report: https://www.huntr.dev/bounties/9708c444-2cf2-4aed-8188-1dc7def05ba1/, should replicate over proper cache-control Proof of Concept Example of sensitive 1 Login to application dashboard 2 Go to lightbox page 3 Click logout. 4 Click go back button to see group...

Cross-Site Request Forgery (CSRF) in collectiveaccess/pawtucket2

Description The following endpoints are vulnerable to CSRF attacks via GET requests even though they use AJAX: 1: Delete lightbox 2: Delete comments 3: Create comments 4: Create comments on objects 5: Add items into lightbox 6: Delete items from lightbox Proof of Concept Copy and paste the...

Improper Access Control in collectiveaccess/pawtucket2

Description After the previous patch fix, users can join the Root group by specifying http://PAWTUCKET-URL/pawtucket/index.php/LoginReg/joinGroup/groupcode/ Proof of Concept http://PAWTUCKET-URL/pawtucket/index.php/LoginReg/joinGroup/groupcode/ Impact Attackers can join the Root group without bei...

in collectiveaccess/providence

Description Sensitive Data can be exposed even after logouting the application due to ui wrong action Proof of Concept 1 login to the application dashboard https://demo.collectiveaccess.org 2 Goto Any pages dashboard,administrations etc 3 Click logout 4 Click browser back button Impact Any other...