fallbrookchamberofcommerce.org XSS vulnerability

Open Bug Bounty ID: OBB-609322 Description| Value ---|--- Affected Website:| fallbrookchamberofcommerce.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Slack: HTTP parameter pollution from outdated Greenhouse.io JS dependency

Slack's career page was using an outdated Greenhouse JavaScript dependency which resulted in an HTTP parameter pollution vulnerability. This would have allowed the loading of external Greenhouse forms not owned by Slack. We updated the Javascript and the issue is resolved. Thanks @irvinlim! The...

gbstamp.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-597261 Description| Value ---|--- Affected Website:| gbstamp.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-8535

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

CVE-2016-8535

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

Design/Logic Flaw

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

CVE-2016-8535

A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found...

HackerOne: HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms

Summary: I noticed that HackerOne career pages loads it's application forms from Greenhouse.io via an iframe. The ghjid parameter value is taken into the iframe element for the token parameter in the iframe URL boards.greenhouse.io. Any html characters are escaped in order to avoid XSS and possib...

WordPress Quotes Collection 2.0.5 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Quotes Collection WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...

AnswerScript 2.7.1 Cross Site Scripting

======================================================================== | Title : AnswerScript v2.7.1 XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : v2.7.1 | Vendor :...

WordPress Contact Bank 2.1.21 Cross Site Scripting

------------------------------------------------------------------------ Cross-Site Scripting in Contact Bank WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016 ------------------------------------------------------------------------...

IRCCloud: Cross Site Scripting(XSS) on IRCCloud Badges Page (using Parameter Pollution)

I. Vulnerability --------------------- IRCCloud is affected by Cross Site Scripting vulnerability in its badges page. www.irccloud.com/badges II. Description --------------------- IRCCloud is open to parameter pollution attacks ie. a parameter passed more than once with different values results i...

auto24.ee XSS vulnerability

Vulnerable URL: http://www.auto24.ee/new/list.php?dmake=10mvid=2100%22%3E%3Cscript%3Ealert%28%22XSSPOSED%22%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 14.03.2016 Latest check for patch:| 14.03.2016 19:23 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

ownCloud: owncloud.com: Parameter pollution in social sharing buttons

Hello Owncloud ! For Example , We Have a Link : https://owncloud.com/blog-you-can-soon-be-fined/ And We Change It To :- https://owncloud.com/blog-you-can-soon-be-fined/?u=https://vk.com&text=anothersite:https://hackerone.com/gorangjoshi So When You Share It , While Using Your Sharing Buttons...

HackerOne: Parameter pollution in social sharing buttons

Hello! For example we have a link https://hackerone.com/blog/introducing-signal-and-impact, and we will change it to https://hackerone.com/blog/introducing-signal-and-impact?&u=https://vk.com/durov. If you send a link to the user and he wants to share a link to facebook, the content will change...

u-Auctions - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This...

u-Auctions - Multiple Vulnerabilities

u-Auctions - Multiple Vulnerabilities Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects...

u-Auctions - Multiple Vulnerabilities

Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects /adsearch.php URL encoded POST input...

pornblink.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-52135 Description| Value ---|--- Affected Website:| pornblink.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Sierra Library Services Platform Multiple Vulnerability Disclosure

Product: Sierra Library Services Platform Vendor: Innovative Interfaces Inc Vulnerable Version: 1.23 Tested Version: 1.23 Vendor Notification: June 19, 2014 Public Disclosure: August 26, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2014-5136 Risk Level: Medium CVSSv2 Ba...