667 matches found
Template injection in cron-utils
Impact A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution RCE vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron...
Cron Utils Injection Vulnerability
Cron Utils is a Java codebase for authenticating, parsing, and migrating Cron expressions from the individual developers at Jmrozanec. An injection vulnerability exists in Cron-utils versions prior to 9.1.3, which can be exploited by an attacker to be able to inject arbitrary Java EL expressions,...
el-trueque.com.ar Cross Site Scripting vulnerability OBB-1489998
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
WordPress < 5.5.2 - Stored XSS in Post Slugs
Description The release notes state: "Thanks to Karim El Ouerghemmi from RIPS who disclosed a method to store XSS in post slugs."...
WordPress <= 5.5.1 - Stored Cross-Site Scripting (XSS) in Post Slugs vulnerability
Stored Cross-Site Scripting XSS in Post Slugs vulnerability found by Karim El Ouerghemmi in WordPress versions = 5.5.1. Solution Update the WordPress to the latest version at least 5.5.2...
CVE-2018-4391
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, watchOS 4.3, iOS 12.1. Processing a maliciously crafted text message may lead to UI spoofi...
Design/Logic Flaw
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, watchOS 4.3, iOS 12.1. Processing a maliciously crafted text message may lead to UI spoofi...
el-camacho.com Cross Site Scripting vulnerability OBB-1377825
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
el-pejs.dk Cross Site Scripting vulnerability OBB-1336714
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Women's Foundation of Boston Empowerment Webinar for Girls and Young Women
Akamai is thrilled to have been the lead sponsor for the recent Women's Foundation of Boston Empowerment Webinar for Girls and Young Women: Girl Decoded: An Intimate Conversation with Author Rana el Kaliouby about finding your voice, pursuing education and excelling as a woman in STEM...
classifieds-prod.elpasotimes.com Cross Site Scripting vulnerability OBB-1279202
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-9297
Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary...
CVE-2020-9296
Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...
Code injection
Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...
el-seif.com.sa Cross Site Scripting vulnerability OBB-1193220
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
el-ing.ru Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1161786 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2020-10693
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...
CVE-2020-10693
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation escaping, stripping controls that developers may have put in place...
Server-Side Template Injection
syncope-client-console is vulnerable to server-side template injection. The attack is possible because it uses different types of interpolation, such as Java EL expressions for handling custom constrain violation error messages during building of Java Bean Validation custom constraint...
CVE-2020-1959
A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution RCE vulnerability. Apache Syncope uses Java Bean Validation JSR 380 custom constraint validators. When...