CVE-2021-38377

OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results...

CVE-2021-38377

OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable UUID with HTML transformation results...

Concrete CMS: Bypass auth.email-domains

Email addresses are stored as VARCHAR64. the length is verified on client side only , using a proxytemper data attacker can add longer length email which can be further abused .Exploiting this is rather straightforward: get an email address of 128 characters long . Now register with your 128...