CVE-2022-26565

Totaljs XSS (CVE-2022-26565): all versions prior to commit 95f54a5commit are vulnerable. An attacker can inject a crafted payload into the Page Name text field during page creation to execute arbitrary web scripts or HTML. The vulnerability is due to unsanitized input in the Page Name field, enab...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit allows attackers to compromise data integrity.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

All Vulnerabilities for tributos.alagoinhas.ba.gov.br Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| tributos.alagoinhas.ba.gov.br ---|---...

web.petropolis.rj.gov.br Cross Site Scripting vulnerability OBB-2457073

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-2257 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.4 through 14.7.6 GitLab CE/EE versions 14.8 through 14.8.4 GitLab CE/EE versions 14.9 through 14.9.1 Description: The issue is related to the lack of protection of the web page structure, allowing for remote attackers...

One Church Management System 1.0 SQL Injection Vulnerability

Exploit Title: One Church Management System 1.0 - attendancy.php search2 SQL Injection Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html Version: 1.0 Tested on: Linux Title: ================ One Church...

dandiwibowo.web.id Cross Site Scripting vulnerability OBB-2448210

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-25582

CVE-2022-25582 describes a stored cross-site scripting (XSS) vulnerability in the ClassCMS Column module, affecting v2.5 and earlier. The root cause is insufficient validation/filtering of user-supplied data in the Add Articles field, allowing an attacker to inject arbitrary script or HTML that i...

CVE-2022-25574

CVE-2022-25574 describes a stored XSS in the upload function /admin/show.php, affecting DouPHP (and related DouPhp/DouShell references in the connected entries). The root cause is insufficient input validation/escaping in the image upload pathway, allowing crafted image files to execute arbitrary...

CVE-2022-26285

CVE-2022-26285 affects Simple Subscription Website v1.0. A SQL injection flaw exists in the apply endpoint’s id parameter, allowing an attacker to dump the database via crafted HTTP requests. Connected sources (NVD/Red Hat/CNVD/CVE records) confirm the vulnerable endpoint and impact. The document...

CVE-2022-26555

CVE-2022-26555 is a stored XSS vulnerability in the Add a Button function of Eova v1.6.0 . The issue allows an attacker to inject arbitrary JavaScript/HTML via the button name text box, enabling script execution in the victim’s browser. Connected sources (Red Hat, NVD, CVE lists) confirm the same...

CVE-2022-25464

CVE-2022-25464 is a stored XSS vulnerability in DoraCMS v2.1.8 affecting the component /admin/contenttemp. The issue allows an attacker to inject arbitrary scripts/HTML via a crafted payload. Public details place CVSSv3.1 base score at 4.8 (MEDIUM) with network access, low attack complexity, user...

Path Traversal due to `send_file` call

A path traversal attack also known as directory traversal aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash ../” sequences and its variations or by using absolute file paths, it may be possible to...

GHSA-FXHP-WRW9-3R97 XML external entity (XXE) injection in Apache Nutch

An XML external entity XXE injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions 1.18. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. ...

XML external entity (XXE) injection in Apache Nutch

An XML external entity XXE injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions 1.18. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. ...

lautenbach.nl Cross Site Scripting vulnerability OBB-2435329

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-26295

CVE-2022-26295 is a stored XSS vulnerability in Online Project Time Management System v1.0, exploitable via /ptms/?page=user by injecting payload into the user name field. The core issue is lack of input validation/filtering and unsafe output handling for user-supplied data. Multiple connected so...

erste-hilfe-koffer.com Cross Site Scripting vulnerability OBB-2433578

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website inside an <iFrame> HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

...

Mozilla: Browser window spoof using fullscreen mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification...