CVE-2022-43121

Subrion CMS v4.2.1 has an XSS in the CMS Field Add page, allowing arbitrary script/HTML via the tooltip text field. Root cause cited as insufficient sanitization in admin-controllable input (notably in fields.php: _assignValues). CVSS 3.1 base score 6.1 (NETWORK, LOW attack complexity, USER inter...

CVE-2022-43119

CVE-2022-43119 affects Clansphere CMS v2011.4. It provides a cross-site scripting vulnerability via the Username parameter, allowing attackers to inject arbitrary web scripts/HTML. Root cause appears to be unsanitized/unchecked input in Username, with impact of script execution in the browser. CV...

CVE-2022-43120

Consolidated details across multiple sources confirm a cross-site scripting (XSS) vulnerability in Subrion CMS v4.2.1, specifically in the /panel/fields/add component. The vulnerability allows an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload placed into the Fi...

webkitgtk: UI spoofing while Visiting a website that frames malicious content

A vulnerability was found in webkitgtk, where an issue was addressed with improved UI handling. Visiting a website that frames malicious content may lead to UI spoofing...

SUSE-SU-2022:3895-1 Security update for ganglia-web

This update for ganglia-web fixes the following issues: - updated to 3.7.5 which fixes bsc1179835 - CVE-2019-20378: Fixed a possible XSS via ce and cs parameters in header.php bsc1160761...

aiticke.mydns.jp Cross Site Scripting vulnerability OBB-3042860

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

smartkomm.de Cross Site Scripting vulnerability OBB-3035830

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

goledger.io Cross Site Scripting vulnerability OBB-3034029

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SQL Injection inside instance name leads to Remote Code Execution

📜 Description SQL injection SQLi is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other...

elbland-philharmonie.de Cross Site Scripting vulnerability OBB-3031674

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-38373

CVE-2022-38373 affects Fortinet FortiDeceptor management interface versions 4.0.2, 4.1.0–4.1.1, and 4.2.0. The issue is an improper neutralization of input during web page generation, enabling a cross-site scripting (XSS) attack by an authenticated user sending requests with a specially crafted l...

Fortinet FortiADC 跨站脚本漏洞

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiADC, which stems from incorrectly neutralizing input during web page generation. An attacker could exploit this vulnerability to execute client-side code...

Reflected Cross Site Scripting leading to session hijacking

Description Basic XSS: XSS Cross-Site Scripting vulnerabilities arise when untrusted data gets interpreted as code in a web context. XSS attacks effectively make the attacker logged in as the target user, with the nasty addition of tricking the user into giving some information such as their...

willowandoakphotography.com Cross Site Scripting vulnerability OBB-3029376

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

turktaslojistik.com Cross Site Scripting vulnerability OBB-3028840

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

e-Excellence U-Office Force 跨站脚本漏洞

e-Excellence U-Office Force is an e-Office platform from China's First Class Technology e-Excellence. U-Office Force suffers from a cross-site scripting vulnerability that stems from insufficient filtering of special characters in HTTP header fields on its UserDefault page, which could allow an...

CVE-2022-40487

CVE-2022-40487 : ProcessWire v3.0.200 is affected by multiple cross-site scripting (XSS) vulnerabilities in the Search Users and Search Pages functions, allowing an attacker to inject arbitrary web scripts or HTML through crafted payloads. This is documented across multiple sources (Red Hat, Vera...

CVE-2022-43169

Rukovoditel v3.2.1 is affected by a stored XSS in the Users Access Groups feature (/index.php?module=users_groups/users_groups). The vulnerability allows authenticated users to inject arbitrary HTML/JavaScript into the Name field after selecting “Add New Group,” which can lead to execution of scr...

TikTok: bypass two-factor authentication in Android apps and web

A vulnerability was found where a random timeout issue on a Two-Step Verification endpoint could have resulted in a potential bypass of authentication if multiple incorrect attempts were entered in quick succession. It was found that this vulnerability required access to the user's email/password...

Stored Cross-site scripting

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. Proof of Concept Visit: http:///phpmyfaq/admin/?action=meta Click button Add template meta data Inject payload in field Page type: "alert"XSS"...