girlgames.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1007899 Security Researcher MrRain1996 Helped patch 959 vulnerabilities Received 4 Coordinated Disclosure badges Received 9 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting girlgames.com website and...

experten-branchenbuch.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1007363 Security Researcher Faizanmark Helped patch 77 vulnerabilities Received 6 Coordinated Disclosure badges Received 58 recommendations , a holder of 6 badges for responsible and coordinated disclosure, found a security vulnerability affecting experten-branchenbuch.de...

minasshopping.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1007130 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

Worry-free cms has arbitrary file deletion vulnerability

Worry-free cms is one of the most professional, most used, most widely used small website builder system for small and medium-sized enterprises to build their own website. Worry-free cms arbitrary file deletion vulnerability, an attacker can take advantage of the vulnerability to arbitrary file...

election.iu.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1004930 Security Researcher devl00p Helped patch 3025 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting election.iu.edu website...

Imgur: De-anonymization Attack: Cross Site Information Leakage

Dear Imgur Security Team, We are researchers at the IMDEA Software Institute in Madrid, Spain. We have been working on analyzing Cross-Site Browser Leaks xsleaks and building a tool for finding instances of it on target web sites. Recently we tested imgur.com and discovered a flaw that can affect...

CVE-2019-5122

YouPHPTube 7.6 exposes authenticated SQL injection vulnerabilities in /objects/pluginSwitch.json.php (parameters uuid, name, dir). The Talos report confirms exploitable injections that could exfiltrate information such as usernames and password hashes and, in some configs, access the underlying O...

CVE-2019-5121

YouPHPTube 7.6 contains authenticated SQL injection vulnerabilities in the /objects/pluginSwitch.json.php endpoint (parameter uuid, name, dir). TALOS documentation describes exploitable, authenticated SQL injections that could exfiltrate database data and, in certain configurations, access the OS...

CVE-2019-5117

CVE-2019-5117 corresponds to an authenticated SQL injection in YouPHPTube 7.6, specifically in /objects/subscribe.json.php (parameter user_id). Exploitation requires being logged in; a crafted request can exfiltrate database content and user credentials, with potential OS access in some configura...

CVE-2019-5116

CVE-2019-5116 is a SQL injection vulnerability in YouPHPTube 7.6, present in the authenticated portion of the application. The TALOS/YouPHPTube advisory describes an exploitable flaw in the /objects/videoAddNew.json.php endpoint (parameter categories_id) that can exfiltrate database information (...

Wordpress Groundhogg SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Wordpress Groundhogg suffers from a SQL injection vulnerability that can be exploited by attackers to execute illegal SQL...

CVE-2019-18419

The provided connected records confirm CVE-2019-18419 is a cross-site scripting (XSS) flaw in ClonOS WEB control panel 19.09, specifically in index.php with the lang parameter. Root cause is described in CNVD as lack of proper validation of client-side data, enabling injection of arbitrary script...

depts.valleycollege.edu Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1002854 Security Researcher devl00p Helped patch 3000 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting depts.valleycollege.edu...

CVE-2019-10475

CVE-2019-10475 affects Jenkins’ build-metrics plugin (1.3 and earlier). It is a reflected cross-site scripting vulnerability where the plugin does not properly escape the label query parameter, allowing an attacker to inject arbitrary HTML/JavaScript into the plugin’s web pages. Impact is user’s ...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

Awesome Web Security 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage of...

seasons.org Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8505 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting seasons.org website and its users. Following coordinated a...

Accounts Accounting 7.02 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Express Accounts Accounting 7.02 - Persistent Cross-Site Scripting Exploit Author: Debashis Pal Vendor Homepage: https://www.nchsoftware.com Source: https://www.nchsoftware.com/accounting/index.html Version: Express Accounts...

Oracle Java SE/Java SE Embedded CVE-2019-2962 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over Multiple protocols. This issue affects the '2D' component. This vulnerability affects the following supported versions: Java SE: 7u231, 8u221, 11.0.4, 13; Java SE...

Oracle Java SE/Java SE Embedded CVE-2019-2981 Remote Security Vulnerability

Description Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. The vulnerability can be exploited over Multiple protocols. This issue affects the 'JAXP' component. This vulnerability affects the following supported versions: Java SE: 7u231, 8u221, 11.0.4, 13; Java S...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36911)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...