CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7993
https://notcve.org/view.php?id=CVE-2020-7993
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field. Prototype versión 1.6.0.1, permite a usuarios autenticados remotos falsificar la creación de tickets (en nombre de otras cuentas de usuario) por medio de un campo email ID modificado. • https://github.com/prototypejs/prototype/blob/master/CHANGELOG https://medium.com/%40vbharad/improper-access-control-vulnerability-in-prototype-1-6-0-1-framework-379cc3a05079 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2008-7220
https://notcve.org/view.php?id=CVE-2008-7220
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cross-site ajax requests" via unknown vectors. Vulnerabilidad sin especificar en Prototype JavaScript Framework (prototypejs) anterior a v1.6.0.2, permite a atacantes remotos realizar "peticiones ajax en sitios cruzados" a través de vectores desconocidos. • https://github.com/followboy1999/CVE-2008-7220 http://github.com/sstephenson/prototype/blob/master/CHANGELOG http://osvdb.org/46312 http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html http://seclists.org/fulldisclosure/2019/May/10 http://seclists.org/fulldisclosure/2019/May/11 http://seclists.org/fulldisclosure/2019/May/13 http://secunia.com/advisories/37479 http://secunia.com/advisories/37677 http://www.debian.org/security/2009/dsa-1952 http:/ •