9719 matches found
CVE-2020-15947
A SQL injection vulnerability in the qmadm/qmexportstatsrun.do endpoint of Loway QueueMetrics before 19.10.21 allows remote authenticated users to execute arbitrary SQL commands via the exportId parameter...
Arbitrary File Read Vulnerability in WiseGiga NAS
Shinhan Import & Export Co., Ltd. is a Korean company that sells NAS products. An arbitrary file read vulnerability exists in WiseGiga NAS, which can be exploited by attackers to obtain sensitive information...
Input validation
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affect...
kkb.co.jp Cross Site Scripting vulnerability OBB-1255442
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
PT-2020-3977 · Microsoft · Dynamics 365 For Finance/Operations
Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 for Finance and Operations version 10.0.11 Description: The issue is related to errors in input data processing, which can allow a remote attacker to execute arbitrary code. An authenticated attacker with privileges to...
CloudForms: Missing access control leads to escalation of admin group privileges
A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes...
CMP - Coming Soon & Maintenance < 3.8.2 - Improper Access Controls on AJAX Calls
Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin deactivation...
WordPress CMP – Coming Soon & Maintenance plugin <= 3.8.1 - Unauthenticated Subscribers List Export vulnerability
Unauthenticated Subscribers List Export vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin versions = 3.8.1. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version at least 3.8.2...
heliotropo.nl Cross Site Scripting vulnerability OBB-1249318
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
robozavr.com Cross Site Scripting vulnerability OBB-1246783
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
istockphoto.com Cross Site Scripting vulnerability OBB-1244419
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
leoteca.es Cross Site Scripting vulnerability OBB-1241677
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
donghothanhdanh.vn Cross Site Scripting vulnerability OBB-1238825
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
dingjiatruckparts.com Cross Site Scripting vulnerability OBB-1237436
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
liwaco.com.hk Cross Site Scripting vulnerability OBB-1236238
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
microfocus.com Cross Site Scripting vulnerability OBB-1234101
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Nextcloud: Formula Injection vulnerability in CSV export feature
Dear Nextcloud Team – I have identified a formula injection vulnerability 12 in the CSV export feature of the Forms App. I am aware that the Forms app is not part of this bug bounty program but was advised to disclose it via hackerone anyway. Description. When a n Excel-/Calc- formula is sent as...
hpplotter.gr Cross Site Scripting vulnerability OBB-1229368
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
fabqb.com Cross Site Scripting vulnerability OBB-1227592
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
paulinhababy.com.br Cross Site Scripting vulnerability OBB-1227299
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...