MISP Cross-Site Scripting Vulnerability (CNVD-2020-16634)

MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. MISP 2.4.122 A reflected cross-site scripting vulnerability exists related to app/View/Users/statisticsorgs.ct...

gitea -- multiple vulnerabilities

The Gitea Team reports: Hide credentials when submitting migration Never allow an empty password to validate Prevent redirect to Host Hide public repos owned by private orgs...

CVE-2018-16607

Cross-site scripting XSS vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field...

Cross site scripting

Cross-site scripting XSS vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field...

CVE-2018-16607

Cross-site scripting XSS vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field...

CVE-2018-16607

Open-AudIT Professional Edition 2.2.7 contains a Cross-Site Scripting (XSS) vulnerability in the Orgs Page, exploitable via the Orgs name field. The issue allows remote attackers to inject arbitrary web script/HTML. Affected software is Open-AudIT Professional Edition (2.2.7); the root cause is r...

CVE-2011-4554

One Click Orgs before 1.2.3 allows remote authenticated users to trigger crafted SMTP traffic via 1 " double quote and newline characters in an org name or 2 " double quote characters in an e-mail address, related to a "2nd Order SMTP Injection" issue...

CVE-2011-4555

One Click Orgs before 1.2.3 does not require unique e-mail addresses for user accounts, which allows remote authenticated users to cause a denial of service login disruption or spoof votes or comments by selecting a conflicting e-mail address...

CVE-2011-4677

One Click Orgs before 1.2.3 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2011-4678

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2011-4553

Multiple open redirect vulnerabilities in One Click Orgs before 1.2.3 allow 1 remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the returnto parameter, and allow 2 remote authenticated users to redirect users to arbitrary web sites and conduct phishing...

CVE-2011-4552

Multiple cross-site scripting XSS vulnerabilities in One Click Orgs before 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the description field of 1 a new vote or 2 the eject member proposal feature...

Code injection

One Click Orgs before 1.2.3 does not require unique e-mail addresses for user accounts, which allows remote authenticated users to cause a denial of service login disruption or spoof votes or comments by selecting a conflicting e-mail address...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in One Click Orgs before 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the description field of 1 a new vote or 2 the eject member proposal feature...

Open redirect

Multiple open redirect vulnerabilities in One Click Orgs before 1.2.3 allow 1 remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the returnto parameter, and allow 2 remote authenticated users to redirect users to arbitrary web sites and conduct phishing...

Design/Logic Flaw

One Click Orgs before 1.2.3 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

Design/Logic Flaw

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2011-4678

The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests...

CVE-2011-4555

One Click Orgs before 1.2.3 does not require unique e-mail addresses for user accounts, which allows remote authenticated users to cause a denial of service login disruption or spoof votes or comments by selecting a conflicting e-mail address...

CVE-2011-4552

CVE-2011-4552 affects One Click Orgs prior to version 1.2.3, with multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the description field of (1) a new vote or (2) the eject member proposal feature. The connected Red Hat, NVD...