CVE-2024-3790: Improper Neutralization of Input During Web Page Generation

Vulnerability in WBSAirback 21.02.04, which consists of a stored Cross-Site Scripting XSS through /admin/SystemUsers, login / description fields, passwd1/ passwd2 parameters. Exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their...

PT-2018-10646

Name of the Vulnerable Software and Affected Versions SearchBlox version 8.6.6 Description The issue concerns a CSRF token bypass in the servlet/UserServlet endpoint. This allows for potential exploitation via the u name, u passwd1, u passwd2, role, and X-XSRF-TOKEN POST parameters. Recommendatio...

CVE-2017-12584: Cross-Site Request Forgery (CSRF)

There is no CSRF mitigation in SLiMS 8 Akasia through 8.3.1. Also, an entire user profile including the password can be updated without sending the current password. This allows remote attackers to trick a user into changing to an attacker-controlled password, a complete account takeover, via the...

CVE-2014-4744: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Phone Number field to open.php or 2 Phone number field, 3 passwd1 field, 4 passwd2 field, or 5 do parameter to account.php...