3667 matches found
DedeCMS /member/reg_new.php SQL注入漏洞
No description provided by source...
DedeCMS /member/buy_action.php SQL注入漏洞
No description provided by source...
XDCMS system\modules\member\index.php SQL注入漏洞
No description provided by source...
Veris: [Stored XSS] sandbox.veris.in
Hello I want to report you another xss... but it's stored Steps to reproduce it : 1 . First create a group . 2. Go to https://sandbox.veris.in/portal/members/ and add a member with name " . 3. Add this member in a group created in step 1 .. . 4. Go to https://sandbox.veris.in/portal/assets/ and...
hd.stheadline.com XSS vulnerability
Vulnerable URL: http://hd.stheadline.com/member/login/?b=%3C/title%3E%3C/script/%27-alert%280%29-%27%22-%22--%3E%3Cimg/onerror=%22;alert%28/OPENBUGBOUNTY/%29;%22src=1%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability...
Veris: Stored XSS in member book
This issue is related to XSS vulnerability in Datatables...
Ultimate Member < 1.3.40 - Cross-Site Scripting (XSS)
The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...
HackerOne: External programs revealing info
A bug in an authorization check was found by @1337coder on an endpoint that was showing the members of a team, as well as the team member groups that were set up. Example output: "id":1, "username":"dirk", "name":"dirk", "bio":"", "url":"https://hackerone.com/dirk" , "id":2, "name":"Admin",...
Veris: Critical - Insecure Direct Object Reference - Deleting any member of any organization remotely
Hello Team, I have found an extremely critical issue with the help of which an attacker can delete any member of any organization. The vulnerability is Insecure Direct Object ReferenceIDOR which leads to privilege escalation as an attacker can perform such a critical attack from his own account...
we7cms redirection vulnerability
we7cms is a content management system based on asp.net development. A redirection vulnerability exists in the member center login page /user/login.aspx of we7cms, which allows an attacker to use this vulnerability to lure users to a malicious page via the returnURL parameter to launch a phishing...
IBM WebSphere Application Server Multiple Vulnerabilities (swg21622444)
IBM WebSphere Application Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Updated ruby-mail packages fix security vulnerability
The Mail library does not impose a length limit on email addresses, so an attacker can send a long spam message via a recipient address unless there is a limit on the application's side. The attacker-injected message in the recipient address is processed by the server. This type of vulnerability...
HackerOne: Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants
Hello Hackerone, I find bug with it team Members associated with a Group have only permission Post internal comments can post comment to all the participants Bypass it just with Add comma ',' isinternal=,...
DEBIAN-CVE-2015-7885
The dgncmgmtioctl function in drivers/staging/dgnc/dgncmgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application...
DEBIAN-CVE-2015-7884
The vividfbioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application...
chitraguptaparivar.com XSS vulnerability
Vulnerable URL: http://chitraguptaparivar.com/memberlogin.php?msg=--!%3E%22%3E%3C/script%20%3E%3Ciframe/onload=alert%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...
HackerOne: Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports
Hi Team, Legend ====== AppSecBounty = Bug ProgramSandbox Program Hacker1001 = Bug Reporter BugAdmin = Program Admin BugMember = Team Member associated ProgramManagement Group ProgramManagement Group = Custom Group created with "Program Management Permission" Steps: 1. Hacker1001 reports a Bug to...
WordPress Symposium 14.05.02 Cross Site Request Forgery
Plugin Name : WP Symposium A8-Cross-SiteRequestForgeryCSRF Effected Version : 14.05.02 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof of Concep...