Adobe Experience Manager 输入验证错误漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A URL...

Adobe Experience Manager 输入验证错误漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A URL...

palmharborortho.com Cross Site Scripting vulnerability OBB-3222601

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-27069

TotalJS OpenPlatform (commit b80b09d) is affected by a stored XSS vulnerability in the account name field. The issue allows an attacker to inject crafted payloads to execute arbitrary web scripts/HTML on the victim’s browser. Reported across multiple sources (NVD, Red Hat, CNNVD, PRION, etc.), th...

CVE-2023-27070

TotalJS OpenPlatform is affected by a stored XSS in the platform name field introduced by commit b80b09d. Affected component: platform name input handling in OpenPlatform. Impact: attacker could execute arbitrary web scripts/HTML in the user’s browser. Exploit details are not described in these d...

Microsoft Dynamics 跨站脚本漏洞

Microsoft Dynamics 365 is a new-generation cloud-based intelligent business application from Microsoft, which helps enterprises grow and transform digitally through the perfect integration of CRM & ERP. A cross-site scripting vulnerability exists in Microsoft Dynamics 365 on-premises, which can b...

putzmeister-baumaschinen.de Cross Site Scripting vulnerability OBB-3219206

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

equitsoissons.free.fr Cross Site Scripting vulnerability OBB-3218261

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

vip.volleyball-verband.de Cross Site Scripting vulnerability OBB-3216471

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-27212

Summary (CVE-2023-27212) : An XSS vulnerability exists in the Online Pizza Ordering System 1.0, specifically in /php-opos/signup.php where a crafted payload in the redirect parameter can execute arbitrary scripts/HTML. The NVD entry lists CVSS v3.1 base score 6.1 (Medium) with NETWORK attack vect...

XSS @ group

Description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Proof of Concept Code: if $groupAction == 'addsave' && $user-perm-hasPermission$user-getUserId, 'addgroup' $user =...

XSS @ Stop Words

Description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Proof of Concept Code 1: $ajaxAction = Filter::filterInputINPUTGET, 'ajaxaction', FILTERUNSAFERAW; $instanceId =...

CVE-2023-26956

onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code...

XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference

Impact Any user with edit rights on a document can trigger a XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. Example to reproduce: Create a forget XAR file and inside it, have the following package.xml content: xml Helper pages...

Debian: Security Advisory (DLA-0014-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

curlycrayy.com Cross Site Scripting vulnerability OBB-3210794

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

iwebsy.com Cross Site Scripting vulnerability OBB-3208583

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Nextcloud: Reflected XSS vulnerability with full CSP bypass in Nextcloud installations using recommended bundle

A reflected XSS vulnerability with full CSP bypass was discovered in Nextcloud installations using the recommended bundle. The vulnerability allowed attackers to inject malicious code into web pages, which could be executed in the context of the victim's browser session, leading to a trivial...

Cisco Prime Infrastructure 跨站脚本漏洞

Cisco Prime Infrastructure is a software application from Cisco USA. It is used to simplify the management of wireless and wired networks. A cross-site scripting vulnerability exists in Cisco Prime Infrastructure that stems from insufficient validation of user-supplied input and can be exploited ...

teler-waf 安全漏洞

teler-waf is a Go HTTP middleware that provides teler IDS functionality to prevent Web-based attacks and improve the security of Go-based Web applications. It is highly configurable and easy to integrate into existing Go applications. A security vulnerability exists in teler-waf versions prior to...