OpenAtlas vulnerabilities

A cross-site scripting (XSS) vulnerability exists in OpenAtlas v8.9.0 due to inadequate validation of user input when a POST request is sent. A remote user can send specially crafted queries to an authenticated user via the "/insert/person/<ID>" petition, "name" and "alias-0" parameters, potentially stealing session cookie details.

A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/event" request to steal session cookie details of an authenticated user.

A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" and "alias-0" parameters in the "/insert/place" request to steal session cookie details of an authenticated user.

A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/source" request to steal session cookie details of an authenticated user.

A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/acquisition" request to steal session cookie details of an authenticated user.

A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" parameter in the "/insert/edition" request to steal session cookie details of an authenticated user.

A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "name" and "alias-0" parameters in the "/insert/group" request to steal session cookie details of an authenticated user.

A Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 is caused by inadequate validation of user input on POST requests. An attacker can send a crafted query via the "creator" and "license_holder" parameters in the "/insert/file" request to steal session cookie details of an authenticated user.