onlinejets.org Open Redirect vulnerability

Open Bug Bounty ID: OBB-1015507 Security Researcher 41PH4 Helped patch 18 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting onlinejets.org website and its users. Following coordinate...

Taxonomy CSV import/export - Moderately critical - Information disclosure - SA-CONTRIB-2019-084

Updated January 9th, 2020 This module enables you to import taxonomy terms from different sources, including a text area, a file upload or a file present in the web server. The module doesn't sufficiently validate user input when providing a local filename to import. This vulnerability is mitigat...

TYPO3 cross-site scripting vulnerability (CNVD-2019-41224)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in TYPO3 versions prior to 4.3.12, 4.4.x prior to 4.4.9 and 4.5.x prior to 4.5.4. The vulnerability stems from a lack of proper validation of...

clk.omgt5.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-1015398 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

explorelocalbox.cratejoy.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-1015288 Security Researcher 41PH4 Helped patch 18 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting explorelocalbox.cratejoy.com website and its users...

fa3.in Open Redirect vulnerability

Open Bug Bounty ID: OBB-1013972 Security Researcher 41PH4 Helped patch 18 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting fa3.in website and its users. Following coordinated and...

Linux kernel buffer overflow vulnerability (CNVD-2019-42727)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A buffer overflow vulnerability exists in the kernel/compat.c file in versions of Linux kernel prior to 3.17 used in Google Chrome OS and other products. The...

CVE-2019-2325

Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150...

CVE-2019-2325

Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150...

Mail.ru: Open Redirect

Hello Team Mail.ru Open Redirect on http://aw.mail.ru/ There is an Open Redirect on http://aw.mail.ru/dynamic/auth/?forumreg= due to the application not checking the value passed by the user to the "forumreg" parameter. User can be redirect to malicious site PoC: Open Redirect...

DedeCMS backend has SQL injection vulnerability

Dream Content Management System DedeCMS is a PHP open source website management system. A SQL injection vulnerability exists in the backend of DedeCMS. The vulnerability stems from the lack of validation of externally entered SQL statements in the database-based application, which can be exploite...

The vulnerability in the implementation of the `waitid` function in Linux kernel allows a malicious actor to exploit their privileges.

The vulnerability of the waitid function implementation in Linux operating systems is related to an unvalidated error state. Exploiting this vulnerability can allow attackers to gain increased privileges...

pixelpost SQL injection vulnerability (CNVD-2019-39945)

pixelpost is a set of PHP and MySQL based , scalable open source photo blog application . A SQL injection vulnerability exists in pixelpost version 1.7.1-5, which stems from a lack of validation of externally-entered SQL statements in the database-based application and can be exploited by an...

YouPHPTube SQL Injection Vulnerability (CNVD-2020-20385)

YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in YouPHPTube version 7.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerability to execute illegal SQL...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-38071)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

rentalyard.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-1001641 Security Researcher Elicx Helped patch 30 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting rentalyard.com website and its users. Following coordinate...

Foxit PhantomPDF Resource Management Error Vulnerability (CNVD-2019-37959)

Foxit PhantomPDF is China's Foxit Foxit company a PDF document reader. stb is a single file for C / C + + public domain library . A resource management error vulnerability exists in Foxit PhantomPDF, which arises from a program that does not validate the existence of an object before performing a...

FreePBX Contactmanager Cross-Site Scripting Vulnerability

FreePBX formerly known as Asterisk Management Portal is the FreePBX project's set of tools for configuring Asterisk IP telephony system through a GUI web-based graphical interface. contactmanager is one of the contact management components used in it. A cross-site scripting vulnerability exists i...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37878)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

GHSA-MVQP-Q37C-WF9J io.ratpack:ratpack-core vulnerable to Improper Neutralization of Special Elements in Output ('Injection')

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' Versions of Ratpack 0.9.1 through and including 1.7.4 are vulnerable to HTTP Response Splitting, if untrusted and unsanitized data is used to populate the headers of an HTTP response. An attacker can...