CVE-2020-8657: Use of Hard-coded Credentials

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token...

CVE-2020-8657

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. Recent assessments: Assessed Attack...

CVE-2020-8115

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older version...

Topcoder: PII of Users Disclosure using "/members/invite/" endpoint

Hello! I found PII Disclosue at https://connect.topcoder.com/projects/ Steps to Reproduce. 1 Go to https://connect.topcoder.com/projects 2 Select an existing project, or create a new one. 3 Select the "Manage Invitations" option. on the left sidebar. 4 Enter the Username/Email of the user you wan...

Debian: Security Advisory (DSA-4612-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-19550

Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL...

Authentication flaw

Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL...

CVE-2019-19550

CVE-2019-19550 concerns a Remote Authentication Bypass in Senior Rubiweb (versions 6.2.34.28 and 6.2.34.37). The underlying issue is an Incorrect Access Control that lets an attacker access admin functionality and view sensitive user information by visiting a specific URI (e.g., /rubiweb/conector...

PT-2020-10185

Name of the Vulnerable Software and Affected Versions Senior Rubiweb versions 6.2.34.28 through 6.2.34.37 Description The issue allows an attacker to bypass remote authentication, gaining admin access to sensitive information of affected users. This can be achieved by providing the correct URL...

CVE-2019-19550: Exposure of Sensitive Information to an Unauthorized Actor

Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of affected users using vulnerable versions. The attacker only needs to provide the correct URL...

CVE-2020-8494

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser servlet allows an attacker with Timekeeper, Master Timekeeper, or HR Admin privileges to gain unauthorized administrative privileges within the application via the empid, userid, pw...

CVE-2020-8495

In Kronos Web Time and Attendance webTA 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate, delegateRole, and...

DEBIAN-CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

UBUNTU-CVE-2020-8086

The modauthldap and modauthldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the isadmin function. This grants remote entities admin-only functionality if their username matches the username of a local admin...

Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2020-23477)

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver. An attacker can exploit the vulnerability to...

CVE-2009-5068

There is a file disclosure vulnerability in SMF Simple Machines Forum affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesyste...

Catfish Blog has a file upload vulnerability

Catfish Blog is a free personal blogging system. A file upload vulnerability exists in Catfish Blog, which can be exploited by an attacker to upload malicious files and gain administrative privileges on the site...

Unspecified Vulnerability in Intelbras IWR 3000N

Intelbras IWR 3000N is a wireless router from Intelbras Poland. A security vulnerability exists in the Intelbras IWR 3000N version 1.8.7, which originates from the fact that when the administrator password is changed from a client's IP address, any client from that IP address can gain...

CVE-2019-15979

Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system OS. For more information about...