377 matches found
Lack of ratelimit on public DAV endpoint
None...
Session Fixation in Nextcloud Talk
None...
Attacker can obtain write access to any federated share/public link
None...
Files Drop public link can be added as federated share
None...
Cross-site Scripting (XSS) - Generic in boxbilling/boxbilling
✍️ Description XSS is possible via support ticket reply functionality for admin. It can happen if a client registers with his name as the XSS payload and admin replies with the default greetings. Otherwise admin have to manually enter the payload in reply form. 🕵️♂️ Proof of Concept 1. Register...
Cross-site Scripting (XSS) - Generic in boxbilling/boxbilling
✍️ Description Xss via support ticket 🕵️♂️ Proof of Concept login into your boxbilling account and create support ticket . put bellow xss payload in support ticket click-me Now save the link and click the and see xss is executed Video Poc--...
Automattic: Able to comment/view in others support ticket at https://en.instagram-brand.com/requests/dashboard
Summary: I reported the vulnerability to Facebook, and they have said to report it here for the bounty. Platforms Affected: https://en.instagram-brand.com/requests/dashboard Steps To Reproduce: 1. Create two account User A, User B at https://en.instagram-brand.com/ 2. Apply for Instagram brand fr...
WordPress Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered Max in WordPress Support Ticket System By Phoeniixx versions = 2.7. Solution This plugin has been closed as of January 31, 2020 and is not available for download. Reason: Security Issue...
Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected XSS
Bad user input sanitisation leads to unauthenticated reflected XSS. Edit WPScanTeam: January 27th, 2020 - Report received & WP Plugin team notified January 31st, 2020 - WP plugin team acknowledgement & plugin closed. April 11th, 2020 - No updates, disclosing. PoC...
Support Ticket System By Phoeniixx <= 2.7 - Unauthenticated Reflected XSS
Bad user input sanitisation leads to unauthenticated reflected XSS. Edit WPScanTeam: January 27th, 2020 - Report received & WP Plugin team notified January 31st, 2020 - WP plugin team acknowledgement & plugin closed. April 11th, 2020 - No updates, disclosing...
Veeam Intelligent Diagnostics signature UID field
If you are not using Veeam ONE or your Veeam ONE server is not connected and monitoring Veeam Backup & Replication, you will not have a VID to enter during case creation. Simply leave the field blank. Purpose This article provides answers to frequently asked questions about the "Veeam Intelligent...
Atlassian Jira CSRF Login Vulnerability
Summary An exploitable CSRF vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. The login form doesn’t require a CSRF token. As a result, an attacker can log a user into the system under an unexpected account. Tested Versions Atlassian Jira 7.6.4 Atlassian Jira 8.1.0 Product URL...
WordPress js-support-ticket plugin cross-site request forgery vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in versions of the WordPress js-support-ticket plugin prior to version 2.0....
CVE-2018-21002
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
CVE-2018-21002
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
Cross site request forgery (csrf)
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
CVE-2018-21002
The CVE-2018-21002 entry affects the WordPress plugin js-support-ticket prior to version 2.0.6, which is vulnerable to Cross-Site Request Forgery (CSRF). The issue is caused by CSRF in the plugin’s handling of requests, enabling unintended state-changing actions on affected sites. NVD lists CVSS ...
CVE-2018-21002
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF...
PT-2019-10429
Name of the Vulnerable Software and Affected Versions js-support-ticket plugin versions prior to 2.0.6 Description The issue affects the js-support-ticket plugin for WordPress, allowing for CSRF attacks. Recommendations For versions prior to 2.0.6, update to version 2.0.6 or later to resolve the...
