Chor4O

An authorization bypass exists due to a user-controlled key, which allows an authorized attacker to elevate privileges over a network.

An issue exists in an unknown functionality where manipulating the `code` argument allows for cross-site scripting (XSS), a technique used to inject malicious scripts into web pages viewed by other users. This attack can be initiated remotely.

A flaw in the Login component allows a remote attacker to perform a manipulation that results in cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites.

A security issue exists in LigeroSmart. Manipulation of the `TicketID` argument within an unknown function of the `/otrs/index.pl` file can lead to cross site scripting. This attack can be launched remotely. The exploit has been publicly disclosed.

A cross-site scripting issue exists in LigeroSmart. The manipulation of the `TicketID` argument in the `/otrs/index.pl?Action=AgentTicketZoom` endpoint can trigger this issue. The exploit is publicly available and could be used for remote attacks. The project has been informed but has not yet responded.

A flaw exists in the Environment Variable Handler component of LigeroSmart. Manipulation of the `REQUEST URI` argument can lead to cross-site scripting. The issue may be exploited remotely. The exploit has been publicly disclosed.

A security issue exists in Qualitor that allows for cross site scripting. The issue is related to manipulation of the `cdscript` argument within an unknown function of the file '/Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php'. This allows for remote attacks. The exploit has been publicly disclosed.

A problematic issue has been found in Luna Imaging, affecting an unknown function of the file /luna/servlet/view/search. The manipulation of the `q` argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

The issue allows an attacker to utilize a false URL and redirect to the URL of their choosing, due to an open redirect in the plugin.

A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user into following a specially crafted URL to the OAuth login page, which could inject and execute malicious javascript code on the user's browser.

A problematic issue has been discovered, affecting the Utility Download Handler component in the /install/ file. The issue can be exploited by manipulating the `lang` argument with a specific input, leading to cross-site scripting. This can be initiated remotely.

A problematic vulnerability has been found in the Portal component of TOTVS RM, specifically in the Login.aspx file. The issue arises from the manipulation of the `VIEWSTATE` argument, leading to cross-site scripting. This vulnerability can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

A problematic vulnerability was found in the Portal component of TOTVS RM, where the manipulation of the argument `d` leads to cross-site scripting. The attack can be launched remotely. The vendor was contacted about this disclosure but did not respond.