1337 matches found
oldoakgdr.it Cross Site Scripting vulnerability OBB-3071521
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-44787
CVE-2022-44787 affects Maggioli Maggioli SpA Appalti & Contratti, version 9.12.2. The vulnerability is a reflected Cross-Site Scripting (XSS) in the web application where the idPagina parameter is reflected in the server response without HTML encoding, allowing/script injection when a user intera...
CVE-2022-44785
CVE-2022-44785 affects Maggioli Maggioli SpA Appalti & Contratti v9.12.2. The vulnerability class is SQL injection in multiple parameters, with at least one instance operable by unauthenticated users (notably cfamm in GetListaEnti.do). Reports from multiple sources (Red Hat, NVD, CVE/CVE list, PT...
CVE-2022-43135
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php...
Cross-Site Request Forgery (CSRF)
Concrete CMS is vulnerable to cross-site request forgery. The vulnerability exists in multiple functions due to lack of checks in the State parameter for external concrete authentication service which allows an attacker to initiate unwanted actions within the web application...
CVE-2022-26954
CVE-2022-26954 affects nopCommerce 4.10–4.50.1 and describes open redirect vulnerabilities that allow remote attackers to phishing-users to attacker-controlled sites through the returnUrl parameter. The returnUrl is processed by the ChangePassword function, SignInCustomerAsync function, Successfu...
eva-strautmann.com Cross Site Scripting vulnerability OBB-2999005
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Does the OWASP Top 10 Still Matter?
What is the OWASP Top 10, and – just as important – what is it not? In this review, we look at how you can make this critical risk report work for you and your organisation. What is OWASP? OWASP is the Open Web Application Security Project, an international non-profit organization dedicated to...
Why a Resilient Content Delivery Network (CDN) is Key to Website Performance
Today’s online users have built-up certain standards of quality when visiting a website. They expect a high performance website with fast page load times and easily accessible, fresh and dynamic content. They also expect to enjoy a seamless and secure experience without downtime or limitations to...
Optimizing a Web Application Security Scan for bWAPP
Today almost all organizations have an online presence, with more information accessible at the click of a mouse, making customer experiences much more frictionless. Yet the delivery of great experiences also opens the door to potential hackers intent on compromising the website and its APIs...
PT-2022-25196 · Unknown · Online Tours & Travels Management System
Name of the Vulnerable Software and Affected Versions: Online Tours & Travels Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/tour/admin/update packages.php" API endpoint...
Virual defacement allows attacker to display any message of his choice
Description This attack involves injecting malicious data into a page of a web application to feed misleading information to users of the application. This kind of attack is known as virtual defacement because the actual content hosted on the target's web server is not modified. The defacement is...
PT-2022-25144 · Owasp +1 · Owasp Modsecurity Core Rule Set +1
Name of the Vulnerable Software and Affected Versions: OWASP ModSecurity Core Rule Set CRS versions 3.0.x through 3.3.2 Description: The issue concerns a response body bypass in the OWASP ModSecurity Core Rule Set CRS. A client can exploit this by issuing an HTTP Accept header field with an...
CVE-2022-34002
The CVE-2022-34002 issue affects PDS Vista 7 and concerns a Local File Inclusion vulnerability in the /application/documents/display.aspx endpoint, specifically the document parameter. A low-privileged authenticated attacker could leak configuration files and source code of the web application. A...
PCI DSS Tackles Client-Side Attacks: Everything You Need to Know About Complying With PCI 6.4.3
Client-side attacks often referred to as Magecart attacks have been around since as early as 2015 and dramatically gained in popularity when the global pandemic accelerated digital transformation, by driving more people and data online. Now the fight against these attacks is stepping up a notch...
CVE-2022-28742
CVE-2022-28742 affects aEnrich eHRD Learning Management Key Performance Indicator System (version 5+). The vulnerability is improper access control: the web application does not validate user sessions on many pages, allowing an unauthenticated attacker to access sensitive functionality. Impact de...
Design/Logic Flaw
Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL...
PT-2022-4428 · Unknown · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: yetiforcecrm versions prior to 6.4.0 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability in the YetiFroce CRM system, which is caused by the lack of protection measures for the web page structure. This allow...
CVE-2022-38358
Eyes of Network Web 5.3 is affected by a cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects multiple endpoints, including /module/admin_notifiers/rules.php (parameters rule_notification, rule_name, rule_name_old), /mod...
