49 matches found
nelsonlabs.com Cross Site Scripting vulnerability OBB-2148533
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Spoofing Bug Highlights Cybersecurity for Digital Vaccine Passports
Three weeks after an independent researcher found a critical bug in the Services Australia COVID-19 digital vaccine certificate that would allow an attacker to falsify someone’s vaccine status, it still hasn’t been fixed. Researcher Richard Nelson looked into the security behind a new digital...
gis.mobile.nelsonmandelabay.gov.za Cross Site Scripting vulnerability OBB-1358471
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
nelsonhealthinsurance.com Cross Site Scripting vulnerability OBB-1197243
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2019-5893
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter...
CVE-2019-5893
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter...
Sql injection
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter...
CVE-2019-5893
OpenSource ERP v6.3.1 is affected by a SQL Injection via the db/utils/query/data.xml query parameter. The root cause is improper handling/validation of input in the query endpoint, allowing injection attacks. A PoC exists (and multiple exploit references describe POSTing to /db/utils/query/data.x...
CVE-2019-5893
Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter...
OpenSource ERP 6.3.1 SQL Injection
Exploit Title: OpenSource ERP SQL Injection Date: 10.01.2019 Exploit Author: Emre AVANA Vendor Homepage: http://www.nelson-it.ch Software Link: http://sourceforge.net/projects/opensourceerp/files/Windows/erp6.3.1.exe/download Version: v6.3.1 Tested on: Windows CVE-2019-5893...
OpenSource ERP 6.3.1. - SQL Injection
OpenSource ERP 6.3.1. - SQL Injection Exploit Title: OpenSource ERP SQL Injection Date: 10.01.2019 Exploit Author: Emre ÖVÜNÇ Vendor Homepage: http://www.nelson-it.ch Software Link: http://sourceforge.net/projects/opensourceerp/files/Windows/erp6.3.1.exe/download Version: v6.3.1 Tested on: Window...
nelson-funeralhome.com XSS vulnerability
Open Bug Bounty ID: OBB-658386 Description| Value ---|--- Affected Website:| nelson-funeralhome.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
teara.govt.nz XSS vulnerability
Open Bug Bounty ID: OBB-628139 Description| Value ---|--- Affected Website:| teara.govt.nz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Why Is Your Location Data No Longer Private?
The past month has seen one blockbuster revelation after another about how our mobile phone and broadband providers have been leaking highly sensitive customer information, including real-time location data and customer account details. In the wake of these consumer privacy debacles, many are lef...
volunteer.nelson-atkins.org XSS vulnerability
Vulnerable URL: http://volunteer.nelson-atkins.org/index.cfm?ErrorMsg=%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:00 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank...
Latest Windows UAC Bypass Permits Code Execution
Less than a month after disclosing a Windows User Account Control bypass, researcher Matt Nelson today published another attack that circumvents the security feature and leaves no traces on the hard disk. This time, the bypass relies on Event Viewer eventvwr.exe, a native Windows feature used to...
VMSA-2016-0011:vRealize Log Insight update addresses directory traversal vulnerability
VMSA-2016-0011 vRealize Log Insight update addresses directory traversal vulnerability. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2016-0011 VMware Security Advisory Severity: Moderate VMware Security Advisory Synopsis: vRealize Log Insight update addresses directory...
Moderate: Red Hat Security Advisory: Red Hat Enterprise Linux 5.8 kernel update
Updated kernel packages that fix one security issue, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the eighth regular update. The Red Hat Security Response Team has rated...
Unbreakable Enterprise kernel security and bug fix update
2.6.32-300.3.1.el6uek - proc: fix oops on invalid /proc/ /maps access Linux Torvalds - Revert 'capabilities: do not grant full privs for setuid w/ file caps + no effective caps' Joe Jin - mm: Use MMFCOMPAT instead ia32compat to prevent kabi be broken Joe Jin - proc: enable writing to /proc/pid/me...
Facebook "Trusted friends" Security Feature Easily Exploitable
Facebook "Trusted friends" Security Feature Easily Exploitable Last week Facebook announced that in one day 600,000 accounts possibly get hacked. Another possible solution for Facebook to combat security issues is to find 3 to 5 "Trusted friends". Facebook will be adding two new security features...