cwao.org.za Cross Site Scripting vulnerability OBB-2839931

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

websterrealestate.com.au Cross Site Scripting vulnerability OBB-2839854

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

universalpracticeapp.com.au Cross Site Scripting vulnerability OBB-2839044

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

airsoft.ua Cross Site Scripting vulnerability OBB-2837300

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Wordfence Launches Wordfence Intelligence for Hosts and Network Defenders

This morning the Wordfence team is launching Wordfence Intelligence live at Black Hat 2022 in Las Vegas. Our entire team is here in Las Vegas, including our international team members. Id like to tell you more about what were launching and how Wordfence Intelligence will help us go even further t...

CVE-2021-41615

The CVE-2021-41615 entry relates to GoAhead WebServer 2.1.8 (websda.c) having insufficient nonce entropy because nonce calculation uses a hardcoded value (onceuponatimeinparadise) that does not comply with RFC 7616/2617 secret-data guidelines. The vulnerability is documented with a high CVSS v3.1...

berthoud.catalog.aspencat.info Cross Site Scripting vulnerability OBB-2825079

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-27617

Synology Calendar's webapi component contains a Path Traversal vulnerability (CVE-2022-27617) affecting versions prior to 2.3.4-0631. The issue stems from an improper limitation of a pathname to a restricted directory, allowing remote authenticated users to download arbitrary files via unspecifie...

CVE-2022-34619

Mealie v0.5.5 is affected by CVE-2022-34619: a stored XSS vulnerability allows attackers to execute arbitrary scripts/HTML via crafted payloads in the Shopping Lists item names field. Root cause: stored XSS in user-provided text. Impact: potential client-side script execution. Remediation: not sp...

photogallery.plugins.editor.apps.webstarts.com Cross Site Scripting vulnerability OBB-2823842

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-site Scripting - Reflected

Description The pricelevel parameter in openemr is vulnerable to reflected XSS Proof of Concept 1. Open the web browser to access the website 2. Access the url: http://openemr.vn/interface/forms/feesheet/review/feesheetoptionsajax.php?pricelevel=%3Cimg%20src%3da%20onerror%3dalertdocument.cookie%3...

cruisegate-hamburg.de Cross Site Scripting vulnerability OBB-2818668

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

UBUNTU-CVE-2022-35653

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

CVE-2022-35653

Moodle LTI module Reflected Cross-Site Scripting (CVE-2022-35653) stems from insufficient sanitization of user-supplied data. A remote attacker can lure a user into opening a crafted link and execute arbitrary HTML/JavaScript in the victim’s browser, potentially stealing data or altering the page...

CVE-2022-35651

CVE-2022-35651 describes a vulnerability in Moodle where insufficient sanitization of user-supplied data in SCORM track details enables a stored XSS and blind SSRF. A remote attacker can lure a user to follow a crafted link and execute arbitrary HTML/script in the context of the vulnerable site, ...

vynckier.nl Cross Site Scripting vulnerability OBB-2813789

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

webservices.icodes.co.uk Cross Site Scripting vulnerability OBB-2813775

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

llhttp: HTTP Request Smuggling when parsing the body of chunked requests

An HTTP Request Smuggling HRS vulnerability was found in the llhttp library, used by Node.JS. During the parsing of chunked messages, the chunk size parameter was not validated properly. In situations where HTTP conversations are being proxied such as proxy, reverse-proxy, load-balancer, an...

CVE-2022-34025

Vesta v1.0.0-5 was discovered to contain a cross-site scripting XSS vulnerability via the post function at /web/api/v1/upload/UploadHandler.php...

CVE-2022-36305

Affected software: Vesta Control Panel (VestaCP) version v1.0.0-5. The issue is a cross-site scripting (XSS) vulnerability in the body function of UploadHandler.php (path: /web/api/v1/upload/UploadHandler.php). Root cause: improper handling of input in the UploadHandler, enabling XSS. Impact: pot...