sejarah-nusantara.anri.go.id Cross Site Scripting vulnerability OBB-2129467

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Block and Stop Bad Bots < 6.62 - Reflected Cross-Site Scripting

The plugin does not escape the page parameter before outputting it back in attributes, leading to a Reflected Cross-Site Scripting issues POST /wp-admin/admin.php?page=sbbmy-custom-submenu-page HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8...

All Vulnerabilities for aulasvirtuales.beataimelda.edu.uy Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| aulasvirtuales.beataimelda.edu.uy ---|-...

All Vulnerabilities for edestek1.kocaeli.edu.tr Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| edestek1.kocaeli.edu.tr ---|--- Open Bu...

All Vulnerabilities for lms.pac.edu.pk Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| lms.pac.edu.pk ---|--- Open Bug Bounty...

All Vulnerabilities for exam.sidtm.edu.in Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| exam.sidtm.edu.in ---|--- Open Bug Boun...

All Vulnerabilities for ted.com Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| ted.com ---|--- Open Bug Bounty Program...

WordPress Plugin Picture Gallery 1.4.2 - 'Edit Content URL' Stored Cross-Site Scripting (XSS)

Exploit Title: WordPress Plugin Picture Gallery 1.4.2 - 'Edit Content URL' Stored Cross-Site Scripting XSS Date: 2021-08-06 Exploit Author: Aryan Chehreghani Software Link: https://wordpress.org/plugins/picture-gallery/ Version: 1.4.2 Tested on: Windows 10 How to Reproduce this Vulnerability: 1...

All Vulnerabilities for eripgip.synology.me Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| eripgip.synology.me ---|--- Open Bug...

All Vulnerabilities for aref-sm.men.gov.ma Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| aref-sm.men.gov.ma ---|--- Open Bug...

in filegator/filegator

Clickjacking is a portmanteau of two words ‘click’ and ‘hijacking’. It refers to hijacking user’s click for malicious intent. In it, an attacker embeds the vulnerable site in an transparent iframe in attacker’s own website and overlays it with objects such as button using CSS skills. This tricks...

Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection

The plugin did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages. http://www.example.com/wp-admin/admin.php?page=pms-members-page&orderby=userid&order=asc,select from...

Chrome casts away the padlock—is it good riddance or farewell?

It’s been an interesting journey for security messaging where browsers are concerned. Back in the day, many of the websites you’d visit on a daily basis weren’t secure. By secure, I mean that they didnt use HTTPS. There was no padlock, which meant that the traffic between you and the website wasn...

In0ri - Defacement Detection With Deep Learning

In0ri is a defacement detection system utilizing a image-classification convolutional neural network. Introduction When monitoring a website, In0ri will periodically take a screenshot of the website then put it through a preprocessor that will resize the image down to 250x250px and numericalize t...

Algolia: Information disclosure -> 2fa bypass -> POST exploitation

Greetings! So i was testing algolia.com. Impressed to find out that there are mitigations in place to prevent POST exploitation such as : When 2fa is enabled we need "old password" to update following things : - To update the password - To disable the 2fa, etc might more more.... And we need 2fa...

The vulnerability of the Sulu content management system, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Sulu content management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

U.S. Dept Of Defense: XSS on https://████████/████' parameter

PoC https://█████/██████████ ███████ Impact XSS on https://████/ System Hosts ███ Affected Products and Versions CVE Numbers Steps to Reproduce Got to https://██████/███ Suggested Mitigation/Remediation Actions...

Responsive Tourism Website 3.1 Remote Code Execution

Exploit Title: Responsive Tourism Website 3.1 - Remote Code Execution RCE Unauthenticated Date: 22.06.2021 Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14838/simple-responsive-tourism-website-using-php-free-source-code.html Version: V 3.1 Tested on: MacOS &...

All Vulnerabilities for escoladegovernodes.londrina.pr.gov.br Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue PoC http://example.com/wp-admin/admin.php?page=buwdrestore=general%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain;%20m0ze...