Veris: Critical IDOR - Delete any venue of any organization remotely

Hello Team, I have found a critical IDOR issue which escalates a user privilege and allows and attacker to delete any venue of any organization remotely through his own account by just changing the venue id in DELETE Request. This is again similar to previously reported critical IDORs to delete a...

Veris: Critical IDOR - Delete any group of any organization remotely

Hello Team, I have found a critical IDOR for deleting any groups of any organization remotely. It means an attacker can easily delete any group of any organization from his account by just chaning the groupid in delete request. This is similar to previously reported IDOR to delete any members. So...

Veris: Critical - Insecure Direct Object Reference - Deleting any member of any organization remotely

Hello Team, I have found an extremely critical issue with the help of which an attacker can delete any member of any organization. The vulnerability is Insecure Direct Object ReferenceIDOR which leads to privilege escalation as an attacker can perform such a critical attack from his own account...

greenfield.org XSS vulnerability

Vulnerable URL: http://greenfield.org/?domain=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 03.03.2016 Latest check for patch:| 03.03.2016 00:30 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 21677549 Google...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...

UBUNTU-CVE-2015-3275

Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...

food.org XSS vulnerability

Vulnerable URL: http://www.food.org/?notfound=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 22.02.2016 Latest check for patch:| 22.02.2016 14:34 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9269475 Google...

piers.org XSS vulnerability

Vulnerable URL: http://piers.org/piersproceedings/piers2012KualalumpurProc.php?searchname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

integraledu.org XSS vulnerability

Vulnerable URL: http://www.integraledu.org/stipendia.php?schoolname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 15:33 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Lt Gen David Deptula on Desert Storm and Islamic State

This weekend Vago Muradian interviewed Lt Gen ret David Deptula, most famous for his involvement as a key planner for the Desert Storm air campaign. I recommend watching the entire video, which is less than 8 minutes long. Three aspects caught my attention. I will share them here. First, Lt Gen...

chronicdisease.org Open Redirect vulnerability

Open Bug Bounty ID: OBB-118559 Description| Value ---|--- Affected Website:| chronicdisease.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

localharvest.org XSS vulnerability

Vulnerable URL: http://www.localharvest.org/unsubscribe.jsp?email=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 10:27 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

Network Vision IntraVue Code Injection Vulnerability

OVERVIEW Researcher Jürgen Bilberger from Daimler TSS GmbH has identified a code injection vulnerability in Network Vision’s IntraVue software. Network Vision has produced a new version that mitigates this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS The...

wingate.org.il XSS vulnerability

Vulnerable URL: https://www.wingate.org.il/ViewImage.asp?Image=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 695503 Google Pagerank| ...

canaacna.org XSS vulnerability

Vulnerable URL: http://canaacna.org/admin/login.php?msg=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 20195986 Google Pagerank| 5 VIP...

iata.org XSS vulnerability

Vulnerable URL: http://www.iata.org/whatwedo/passenger/tariffs/Pages/multilateral-interline-system.aspx?x" Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 23:16 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

knx-gateway-info NSE Script

Identifies a KNX gateway on UDP port 3671 by sending a KNX Description Request. Further information: DIN EN 13321-2 Example Usage nmap -sV -sC Requires nmap shortport ipOps stdnse string knx local nmap = require "nmap" local shortport = require "shortport" local ipOps = require "ipOps" local stdn...

change fontset 'icons' to html entities to improve security compliance

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-38988. panel It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization...

change fontset 'icons' to html entities to improve security compliance

It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization especially banks that have strict security constraint fontset cannot be downloaded as a result this will not render on customer instance. I would recommend that we change the current...

search.clearch.org XSS vulnerability

Vulnerable URL: http://search.clearch.org/?a=web=%27%22%3E%3Cimg%20src%3Dx%20onerror%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 14:01 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...