9707 matches found
CVE-2020-15773
An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user for the duration of the browser session after previously explicitly authenticating with the API...
Cross site scripting
An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user for the duration of the browser session after previously explicitly authenticating with the API...
CVE-2020-15773
An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user for the duration of the browser session after previously explicitly authenticating with the API...
pitonboxklub.amivarosunk.info Cross Site Scripting vulnerability OBB-1346411
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
DEBIAN-CVE-2020-25729
ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php...
WordPress Import / Export Customizer Settings plugin <= 1.0.3 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Import / Export Customizer Settings plugin versions = 1.0.3. Solution Update the WordPress Import / Export Customizer Settings plugin to the latest available version at least 1.0.4...
katzenverrueckte.xobor.de Cross Site Scripting vulnerability OBB-1333016
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-16857
A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...
CVE-2020-4693
IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code on the system, caused by improper validation of data prior to export. IBM X-Force ID: 186782...
Information Disclosure in TYPO3 extension sf_event_mgt
A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. Another missing access check in the backend module allows an authenticated backend user to send emai...
GHSA-G8RG-7RPR-CWR2 Information Disclosure in TYPO3 extension sf_event_mgt
A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. Another missing access check in the backend module allows an authenticated backend user to send emai...
favana-docx (>=1.0.28, <=1.0.47), web-commons-export (1.2.10) potentially affected by unknown CVE via office-converter (1.0.2)
office-converter NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on office-converter and may be impacted: - favana-docx =1.0.28, =1.0.47 - web-commons-export 1.2.10 Source cves: unknown CVE Source advisory: OSV:GHSA-9P64-H5Q4-PHPM...
Information Disclosure in extension "Localization Manager" (l10nmgr)
A missing access check allows an authenticated backend user to view and export data of translatable fields which are outside of the users access scope resulting in Information Disclosure...
autofair.com Cross Site Scripting vulnerability OBB-1292190
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
openbugbounty.org Cross Site Scripting vulnerability OBB-1285115
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
nusatekstile.ru Cross Site Scripting vulnerability OBB-1283241
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
biomedltravel.com Cross Site Scripting vulnerability OBB-1282456
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CloudForms: Missing access control leads to escalation of admin group privileges
A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes...
amerysd.k12.wi.us Cross Site Scripting vulnerability OBB-1280732
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
calas.co Cross Site Scripting vulnerability OBB-1275033
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...