CVE-2020-1103 Microsoft SharePoint Information Disclosure Vulnerability

...

Microsoft SharePoint Information Disclosure Vulnerability

An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks a variant of cross-site request forgery, CSRF. When users are simultaneously logged in to Microsoft SharePoint Server and visit a...

Rockstar Games: Information Disclosure in https://www.rockstargames.com/search

In this report the researcher identified a flaw in our search function that caused it to display unintended error messages. These error messages contained detailed error codes that could reveal information useful to attackers. Thanks to this report we were able to address this behavior so that th...

LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting

LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting Exploit Title: LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting Date: 2020-01-14 Vendor Homepage: https://www.learndash.com Vendor Changelog: https://learndash.releasenotes.io/release/uCskc-version-312...

CVE-2020-8645

An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulnerable parameter is jobid. The function is getJobApplicationsByJobId. The file is lib/class.JobApplication.php...

Apache Atlas Stored Cross-Site Scripting Vulnerability

Apache Atlas is a scalable set of core infrastructure governance services that enable organizations to efficiently meet compliance requirements in Hadoop and allow integration with the entire enterprise data ecosystem. A stored cross-site scripting vulnerability exists in the search function in...

HackerOne: Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible

Summary: It appears I'm able to discover words used in limited disclosed reports, that are not publicly visible, by using the search function available from the Hactivity page. Description: Recently I was investigating a finding for another program which involved exploiting XSS ████. I wondered h...

CVE-2019-9230

An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.253. A cross-site scripting XSS vulnerability in the search function of the management web interface allows remote attackers to inject arbitrary web script o...

Information Disclosure

trytond is vulnerable to information disclosure. There is no checking for order against the field value in the search function, allowing an authenticated user to guess a field for which he has no access right and order records based on that value...

EI-Tube 3 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PHP EI-Tube Script - Sql Injection Exploit Author: Meisam Monsef - email protected Vendor Homepage: https://codecanyon.net/item/eitube-youtube-api-v3-site-builder/22722912?srank=17 Version: 3 Tested on: ubuntu special thanks :...

CVE-2018-20508

CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...

CVE-2018-8580

CVE-2018-8580 is an information-disclosure vulnerability in Microsoft SharePoint Server where certain search modes are vulnerable to a CSRF-like cross-site search attack. An attacker can induce queries as a logged-in user to infer whether documents are present in search results, without exposing ...

389-ds-base: Mishandled search requests in servers/slapd/search.c:do_search() allows for denial of service

It was found that a specially crafted search query could lead to excessive CPU consumption in the dosearch function. An unauthenticated attacker could use this flaw to provoke a denial of service...

Red Hat 389 Directory Server Denial of Service Vulnerability (CNVD-2019-02473)

Red Hat 389 Directory Server formerly known as Fedora Directory Server is an enterprise-class Linux directory server from Red Hat. The server fully supports the LDAPv3 specification and features scalability, multi-master replication, and more. A security vulnerability exists in the 'dosearch'...

oxford-med.com.ua XSS vulnerability

Open Bug Bounty ID: OBB-682966 Description| Value ---|--- Affected Website:| oxford-med.com.ua Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

kcentr.ru XSS vulnerability

Open Bug Bounty ID: OBB-682642 Description| Value ---|--- Affected Website:| kcentr.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

cannondalebikes.pl XSS vulnerability

Open Bug Bounty ID: OBB-681890 Description| Value ---|--- Affected Website:| cannondalebikes.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-17218

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function...

blog.boyet.com XSS vulnerability

Open Bug Bounty ID: OBB-678243 Description| Value ---|--- Affected Website:| blog.boyet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-15679

An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting...