4083 matches found
Cross-Site Request Forgery (CSRF) in francoisjacquet/rosariosis
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in francoisjacquet/rosariosis
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in francoisjacquet/rosariosis
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in francoisjacquet/rosariosis
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in francoisjacquet/rosariosis
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in easysoft/zentaopms
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
in zeromq/pyzmq
āļø Description The paramiko.WarningPolicy policy used in setmissinghostkeypolicy will not reject unknown host keys. This may lead to Man-in-the-middle attacks. šµļøāāļø Proof of Concept client = paramiko.SSHClient client.loadsystemhostkeys client.setmissinghostkeypolicyparamiko.WarningPolicy š„ Impact...
in pimcore/pimcore
1Go to https://demo.pimcore.fun/en/account/register 2Enter the username and password 3Choose the password as 'a' and the account will be created...
Cross-Site Request Forgery (CSRF) in changeweb/unifiedtransform
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in changeweb/unifiedtransform
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-site Scripting (XSS) - Reflected in dolibarr/dolibarr
Description Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious...
Cross-Site Request Forgery (CSRF) in pimcore/pimcore
āļø Description Your application have not any CSRF protection and also You set the SameSite attribute to Lax, this means if you want to alter some data with GET HTTP requests, then your site should be vulnerable to CSRF attacks with no doubt. First you run this Html payload and then you should see...
Use of a Broken or Risky Cryptographic Algorithm in serghey-rodin/vesta
āļø Description uniqid does not generate cryptographically secure strings, even if it did, supplying it with mtrand would render it insecure as an attacker would be able to gain access to a victim's account by simply knowing when they logged in, this could be used as a mass-account-takeover vector...
Business Logic Errors in pimcore/pimcore
āļø Description Pimcore is vulnerable to Business Logic error through negative products amount. šµļøāāļø Proof of Concept HTML content: HTML 1. Save the above content into an HTML file. 2. Open the HTML file on the browser and click on Submit button. 3. Check out the total price. PoC video. š„ Impact It...
Inefficient Regular Expression Complexity in erxes/erxes
āļø Description If we want to use Regex in our match or search or replace or ā¦ functions, we must be sanitize this function's inputs. if an attacker capable to inject any Regex or abuse the exponential Regexes that used in our codes, then the ReDoS vulnerability appear and according to "freezing th...
Cross-Site Request Forgery (CSRF) in ampache/ampache
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in ampache/ampache
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in ampache/ampache
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in ampache/ampache
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in ampache/ampache
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Cross-Site Request Forgery (CSRF) in ampache/ampache
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
in alovoa/alovoa
āļø Description Affected versions of this package are vulnerable to XML External Entity XXE Injection via the SAML2AssertionValidator method. Access to external entities was not disabled in XML parsing. šµļøāāļø Proof of Concept org.springframework.security spring-security-oauth2-client...
in janeczku/calibre-web
āļø Description The attribute name is not properly restricted so a user can change his username even when the view does not allow to change it. šµļøāāļø Proof of Concept //The method changeprofile saves also de name if it is present in the request. It does not check if the user has the permission to...
Cross-Site Request Forgery (CSRF) in janeczku/calibre-web
āļø Description An attacker can make a user change his profile settings by CSRF vulnerability through PoC file. There is no CSRF token. šµļøāāļø Proof of Concept For example, changing the email address from "[email protected]" to "[email protected]" test1's profile. Make the user open a link with this page...
in kestasjk/webdiplomacy
āļø Description According to previous explanation about weak cryptographic tokens, you also send the same weak token to users that forgot their passwords. here an attacker can also do Bruteforce attacks to take control of users accounts. šµļøāāļø Proof of Concept...
Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy
āļø Description CSRF bug to watch a game šµļøāāļø Proof of Concept no csrf token checking during watch game.\ Bellow request is vulnerable to csrf attack POST /redirect.php HTTP/1.1 Host: webdiplomacy.net User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:88.0 Gecko/20100101 Firefox/88.0 Accept:...
Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy
āļø Description CSRF bug when contacting team šµļøāāļø Proof of Concept no csrf token contact .\ Bellow request is vulnerable to csrf attack POST /contactUsDirect.php HTTP/1.1 Host: webdiplomacy.net User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:88.0 Gecko/20100101 Firefox/88.0 Accept:...
Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy
āļø Description CSRF bug when disabling notice šµļøāāļø Proof of Concept no csrf token checking during enable/desable notice .\ Bellow request is vulnerable to csrf attack POST /index.php HTTP/1.1 Host: webdiplomacy.net User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:88.0 Gecko/20100101...
Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy
āļø Description CSRF bug when creating game šµļøāāļø Proof of Concept no csrf token checking during gamecreate .\ Bellow request is vulnerable to csrf attack POST /gamecreate.php HTTP/1.1 Host: webdiplomacy.net User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:88.0 Gecko/20100101 Firefox/88.0...
in kestasjk/webdiplomacy
āļø Description Bypass rate limit and sent unlimited email to any email address. š„ Impact Attacker can sent unlimited email to any mail address . Many email service provider has limited email sending like 10000 email per month . If you exeed that limit then you will be extra charged . So, using thi...
Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy
āļø Description csrf bug to change user profile šµļøāāļø Proof of Concept I see there no csrf token checking when updating user-profile save bellow html code in html file and host this file . Now sent this file link to vicitm when victim open the link then his profile information will be changed...
Code Injection in causefx/organizr
āļø Description The "version": "v6.4.1", is vulnerable to code injection, Affected versions of this package are vulnerable to Arbitrary Code Execution. If the $langpath parameter is passed unfiltered from user input, it can be set to a UNC path, and if an attacker is also able to persuade the serve...
Cross-Site Request Forgery (CSRF) in emoncms/dashboard
š„ BUG csrf bug to change schedule to public š„ STEP TO REPRODUCE 1. First login into your account and open the link http://localhost/emoncms/schedule/set.json?id=1&fields=%22public%22:true and your schedule will be change from private to public. š„ IMPACT Any attacker can send those link to vicitm...
in emoncms/dashboard
š„ BUG account takeover via host-header injection It allow attacker to change url of account-verification link and verify any email-address . š„ STEP TO REPRODUCE 1. First as attacker create a account with email [email protected]. You dont own that email-address .\ You cant login untill you verify that...
Cross-Site Request Forgery (CSRF) in emoncms/dashboard
š„ BUG csrf bug to regenerate api-key š„ STEP TO REPRODUCE 1. First login into your account and open the link http://localhost/emoncms/user/newapikeywrite.json and a new api key will be generated. š„ IMPACT Any attacker can send those link to vicitm and when vicitm open the link then api-key will be...
Cross-Site Request Forgery (CSRF) in emoncms/dashboard
š„ BUG csrf bug to change email š„ STEP TO REPRODUCE 1. First login into your account and open the link http://localhost/emoncms/user/changeemail.json?&email=admin%40localhost.combm and your email will be changed. š„ IMPACT Any attacker can send those link to vicitm and when vicitm open the link the...
Cross-Site Request Forgery (CSRF) in emoncms/emoncms
āļø Description When you don't set the SameSite attribute of cookies the browsers have special act in front of this issue.I mean set default value on it chrome and chromium based browsers set the attribute "Lax" that mean if you do add/delete/alter operation in a get HTTP request then your site mor...
Improper Privilege Management in opensource-socialnetwork/opensource-socialnetwork
š„ BUG unprivileged user can like to private album . š„ IMPACT user who does not have permiison in private album still can comment in that album. š„ STEP TO RERPODUCE There is two user called user-A and user-B.\ 1. First goto user-A account and create a private album . \ Lets album url is...
Improper Privilege Management in opensource-socialnetwork/opensource-socialnetwork
š„ BUG unprivileged user can comment to private album . š„ IMPACT user who does not have permiison in private album still can comment in that album. š„ STEP TO RERPODUCE There is two user called user-A and user-B.\ 1. First goto user-A account and create a private album . \ Lets album url is...
in janeczku/calibre-web
āļø Description A user can see the name of another user's private shelf through a forbidden error. šµļøāāļø Proof of Concept 1. As user 1, try to add a book to a user 2's shelf: GET /shelf/add/2/2 2. See the returned error: Sorry you are not allowed to add a book to the the shelf: shelf test2 This is...
Improper Access Control in janeczku/calibre-web
āļø Description A user can edit the title of another user's shelf. šµļøāāļø Proof of Concept The function editshelf calls directly to createeditshelf sending the queried shelf by the id from the path withouth checking if that shelf is theirs. // shelf.py @shelf.route"/shelf/edit/", methods="GET",...
in janeczku/calibre-web
āļø Description The app does not expire the user's session after the logout. It is possible to continue using the session even when the user has logged out. šµļøāāļø Proof of Concept 1. Login as a user at /login. 2. Select logout, intercepting and copying the user's cookie. 3. After this logout, send a...
None in firefly-iii/firefly-iii
Improper Restriction of Excessive Authentication Attempts. The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks. STEPS FOR REPRODUCTION: 1Go to...
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
āļø Description CSRF bug to close a project šµļøāāļø Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when closing a project ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
āļø Description CSRF bug to activate all contractline šµļøāāļø Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when activate all contract-line ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
āļø Description CSRF bug to remove third-party from sales-order šµļøāāļø Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when removing third-party from sales-order ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
āļø Description CSRF bug to classify bill of sales-order šµļøāāļø Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when classify bill of sales-order ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
āļø Description CSRF bug to delete warehouse šµļøāāļø Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when delete warehouse ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
āļø Description CSRF bug to validate inventory šµļøāāļø Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when validate inventory ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
āļø Description CSRF bug to delete product variants šµļøāāļø Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when delete product variants ....