PT-2019-7157

Name of the Vulnerable Software and Affected Versions Bilboplanet version 2.0 Description A stored XSS issue exists due to improper handling of user input in the fullname parameter to the "signup.php" endpoint. Recommendations For Bilboplanet version 2.0, update the software to a version that...

CVE-2014-9919: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php...

CVE-2018-14924

Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" aka user fullname field...

Cross site scripting

Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" aka user fullname field...

CVE-2018-14924

CVE-2018-14924 affects Matera Banco 1.0.0. The connected sources describe a stored XSS in the application, exploitable via the sca/privilegio/consultarUsuario.jsf “Nome Completo” field. CNVD notes a remote attacker can inject arbitrary script/HTML, consistent with stored XSS. No patch/version rem...

Synology Photo Station elevation of privilege vulnerability (CNVD-2018-11290)

Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A security vulnerability exists in Synology Photo Station versions prior to 6.8.5-3471 and prior to 6.3-2975. A remote attacker can exploit the vulnerability to perform a power lifting attack...

CVE-2018-8926

Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...

Privilege escalation

Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...

PT-2018-18724

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.8.5-3471 Synology Photo Station versions prior to 6.3-2975 Description The issue is related to a permissive regular expression vulnerability in the synophoto dsm user component of Synology Photo...

CVE-2018-8926: Permissive Regular Expression

Permissive regular expression vulnerability in synophotodsmuser in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter...

Design/Logic Flaw

Moodle 3.x has user fullname disclosure on the user preferences page...

CVE-2017-2642

Moodle 3.x has user fullname disclosure on the user preferences page...

CVE-2017-2642

Moodle 3.x has user fullname disclosure on the user preferences page...

CVE-2017-2642

Moodle 3.x has user fullname disclosure on the user preferences page...

CVE-2017-2642

CVE-2017-2642 affects Moodle 3.x, causing a user fullname disclosure on the user preferences page. The incident is supported by multiple feeds in connected data, including CVE reporting and OpenVAS/Nessus entries that reference Moodle moodle 3.x and the associated Fedora updates. CVSS metrics ind...

CVE-2017-2642

Moodle 3.x has user fullname disclosure on the user preferences page...

PT-2017-15460

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x Description The issue concerns a user fullname disclosure on the user preferences page. Recommendations For Moodle versions 3.x, update to a version where this issue is resolved or restrict access to the user preferences pa...

WakaTime: [Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge

Hi Team, Summary I have found a vulnerability, Which is you can change/update others Fullname without there knowledge. Step-by-step Reproduction Instructions 1. login your account https://wakatime.com/login 2. after you login go to Leaderboard then click Create new one or in easy way is to go her...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 tribename or 2 tags parameter in a tribes page request to user/ or the 3 userid or 4 fullname parameter to signup.php...

CVE-2014-9916

Multiple cross-site scripting XSS vulnerabilities in Bilboplanet 2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 tribename or 2 tags parameter in a tribes page request to user/ or the 3 userid or 4 fullname parameter to signup.php...