seguraprocuradores.es Improper Access Control vulnerability OBB-3825862

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-50891

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows Stored XSS.This issue affects Form plugin for WordPress – Zoho Forms: from n/a through 3.0.1...

CVE-2023-41813

CVE-2023-41813 (Pandora FMS) is a Cross‑Site Scripting vulnerability affecting Pandora FMS versions 700–774. The issue arises from improper neutralization of input during web page generation, enabling XSS that allows editing the Web Console user notification options. Documented impact is limited ...

CVE-2023-50881

CVE-2023-50881 is a Stored XSS vulnerability in the WordPress plugin Advanced Access Manager (AAM) – Restricted Content, Users & Roles, Enhanced Security and More, affecting up to version 6.9.15. Root cause is Improper Neutralization of Input During Web Page Generation. Public sources (Red Hat an...

CVE-2023-51396

The CVE-2023-51396 entry concerns Brizy – Page Builder (WordPress plugin) with stored XSS in the Brizy shortcode output. Affected versions are Brizy – Page Builder up to and including 2.4.29; the vulnerability stems from improper input neutralization during web page generation. Impact, as describ...

CVE-2023-50860

CVE-2023-50860 is a Stored XSS in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress, affecting Amelia Booking versions up to 1.0.85. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious input to be reflected and...

CVE-2023-43955

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData...

CVE-2023-49119

GROWI contains a stored XSS vulnerability (CVE-2023-49119) via img tags in versions prior to 6.0.0. An attacker could execute arbitrary JavaScript in a user’s browser when visiting a compromised page. The issue is confirmed in multiple sources (Red Hat, OSV, JVN, CNA entries) and is listed among ...

CVE-2023-47215

CVE-2023-47215 is a stored cross-site scripting vulnerability affecting WESEEK GROWI prior to version 6.0.0. The issue arises from the XSS Filter behavior and can allow arbitrary script execution in a user’s browser when visiting the site. Multiple sources (NVD/Red Hat/JVN/PT-Security CNNVD) cons...

mundolindo.es Improper Access Control vulnerability OBB-3822777

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

weborder.husqvarna.com IFRAME Injection vulnerability OBB-3820722

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

maisons-auguste.fr Cross Site Scripting vulnerability OBB-3819835

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fitforfun.de Cross Site Scripting vulnerability OBB-3819809

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2023-9993755)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2023-50830

CVE-2023-50830 affects Seos Contact Form up to version 1.8.0, with an Unpatched Stored Cross-Site Scripting vulnerability in input handling during web page generation. Root cause is improper neutralization of input, enabling stored XSS. Public references (Wordfence/Red Hat) corroborate the CVE an...

CVE-2023-50823

CVE-2023-50823 is a stored XSS in the WordPress plugin CSS & JavaScript Toolbox (affected up to version 11.7). The issue stems from improper input neutralization during web page generation, enabling stored scripts to execute in the context of the affected site. Public issuances (NVD and Red Hat) ...

natural-esthetics.com Cross Site Scripting vulnerability OBB-3819503

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild - Update ASAP

Google has rolled out security updates for the Chrome web browser to address a high-severity zero-day flaw that it said has been exploited in the wild. The vulnerability, assigned the CVE identifier CVE-2023-7024, has been described as a heap-based buffer overflow bug in the WebRTC framework that...

karneval-in-goettelborn.de Improper Access Control vulnerability OBB-3819179

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:4912-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4912-1 advisory. - Firefox Extended Support Release 115.6.0 ESR changelog-entry bsc1217974 CVE-2023-6856: Heap-buffer-overflow affecting WebGL...