biographi.ca Cross Site Scripting vulnerability OBB-3491163

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

derbyshirescouts.org Cross Site Scripting vulnerability OBB-3490252

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

auktionen-vogler.ch Cross Site Scripting vulnerability OBB-3488728

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

hclitomysl.cz Cross Site Scripting vulnerability OBB-3488479

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Automattic: reflected xss in https://wordpress.com/start/account/user

A reflected cross-site scripting vulnerability was exploited in the account user page of a website. By appending malicious JavaScript code to the redirect URL parameter after authenticating, reflected XSS could be triggered when users clicked continue on the account user page...

changerichelieu.fr Cross Site Scripting vulnerability OBB-3485859

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

asiatec.com Cross Site Scripting vulnerability OBB-3485006

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bon-allez.fr Cross Site Scripting vulnerability OBB-3483607

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

omartin-restaurant.fr Cross Site Scripting vulnerability OBB-3483073

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-33664

CVE-2023-33664 affects the ai-dev aicombinationsonfly project, with a SQL injection vulnerability in the /includes/ajax.php component. The issue is present in versions prior to 0.3.1; upgrading to version 0.3.1 or later is the stated remediation. The CVE entry provides a high severity (CVSS 3.1: ...

U.S. Dept Of Defense: RCE via File Upload with a Null Byte Truncated File Extension at https://██████/

A remote code execution vulnerability via file upload with a null byte truncated file extension was found on a website. By uploading a file with .asp%00.png extension, malicious ASP code could be executed on the server. This allowed an attacker to run arbitrary system commands. The issue was...

appel-d-offres.fr Cross Site Scripting vulnerability OBB-3481317

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-37131

A Cross-Site Request Forgery CSRF in the component /public/admin/profile/update.html of YznCMS v1.1.0 allows attackers to arbitrarily change the Administrator password via a crafted POST request...

CVE-2023-37136

Summary: CVE-2023-37136 is a stored XSS vulnerability in the Basic Website Information module of eyoucms v1.6.3. The issue allows an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload. The NVD entry lists CVSS‑3.1 metrics: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N with a...

CVE-2023-37132

CVE-2023-37132 affects eyoucms v1.6.3 in the custom variables module. It is a stored XSS vulnerability that allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. The CVSS v3.1 base score is 5.4 (Medium) with network attack vector, low attack complexity, required user ...

CVE-2023-37133

The CVE-2023-37133 entry relates to a stored XSS vulnerability in the Column management module of eyoucms v1.6.3. Technical details across connected sources consistently indicate the issue stems from insufficient input filtering/escaping in that module, allowing an attacker to inject and execute ...

westernhanoihotel.com Cross Site Scripting vulnerability OBB-3479836

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

trimerabrands.com Cross Site Scripting vulnerability OBB-3479534

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2020-23452

CVE-2020-23452 affects Selenium Grid v3.141.59. The XSS vulnerability occurs in the hub parameter on the /grid/console page, allowing injection of arbitrary scripts/HTML. Documented impact is privacy/Integrity concerns with low to moderate severity (CVSS v3.1 base 6.1). No patch or remediation de...

CVE-2023-31999

CVE-2023-31999 affects all versions of @fastify/oauth2 due to a statically generated OAuth2 state parameter at startup, reused across requests for all users and sessions. This CSRF flaw could enable forged requests. The issue was addressed in v7.2.0, which switches to per-user state stored in a c...