326 matches found
Simple Water Refilling Station Management System 代码问题漏洞
Simple Water Refilling Station Management System is a simple water refilling station management system . A code issue vulnerability exists in Simple Water Refilling Station Management System 1.0, which originates in classes/ System Logo option and updatesettings on the systeminfo page in...
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component
The cover photo and profile photo upload functionalities of the plugin were vulnerable to arbitrary file uploads due to the use of exifimagetype for filetype checking. 'Hax0r2', 'regemail' = '[email protected]', 'regpassword' = 'password', 'regpasswordpresent' = 'true', 'regfirstname' = 'Hax0r2',...
CVE-2021-24241
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page...
CVE-2021-24241: Improper Neutralization of Input During Web Page Generation
The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page...
Advanced Custom Field Pro < 5.9.1 - Reflected Cross-Site Scripting (XSS)
The plugin did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page. PoC The PoC will be displayed on April 16, 2021, to give users the time to update...
TCL Communication Alcatel Cingular Flip 2 B9HUAH1 Injection Vulnerability
The TCL Communication Alcatel Cingular Flip 2 B9HUAH1 is a cell phone from TCL Communication TCL, a Chinese company. A security vulnerability exists in the TCL Communication Alcatel Cingular Flip 2 B9HUAH1, which stems from an undocumented Web API in the device that allows JavaScript code to be...
CVE-2019-16243
On TCL Alcatel Cingular Flip 2 B9HUAH1 devices, there is an undocumented web API that allows unprivileged JavaScript, including JavaScript running within the KaiOS browser, to view and edit the device's firmware over-the-air update settings. This web API is normally used by the system application...
CVE-2017-18584
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action...
WP Slimstat <= 4.8.3 - CSRF to Stored XSS and Setting Updates
Lack of CSRF check and sanitisation in the updatesettings function can lead to settings update, as well as Stored XSS issues PoC...
CVE-2019-13344: Missing Authentication for Critical Function
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains function in wplikebutton.php did not check if the current request is made by an authorized user, thus allowing any...
June 18, 2019—KB4501371 (OS Build 17763.592)
None None...
May 21, 2019—KB4499183 (OS Build 17134.799)
None None...
May 21, 2019—KB4497934 (OS Build OS 17763.529)
None None...
BanManager WebUI 1.5.8 - PHP Code Injection
BanManager WebUI 1.5.8 - PHP Code Injection BanManager WebUI 1.5.8 - PHP Code Injection & Stored XSS Exploit Title: BanManager WebUI - PHP Code Injection & Stored XSS Date: 2017-05-10 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage:...
BanManager WebUI 1.5.8 - PHP Code Injection
BanManager WebUI 1.5.8 - PHP Code Injection & Stored XSS Exploit Title: BanManager WebUI - PHP Code Injection & Stored XSS Date: 2017-05-10 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/BanManagement/BanManager-WebUI Software Link:...
Google Play App Permissions Privacy, Security Concerns
Google’s revamped app permissions for Google Play are not being well received by Android users. Reddit threads are rife with adjectives such as “stupid” and “dangerous,” primarily because Google’s attempt to simplify permissions granted to automatically updated applications may in fact expose use...
CVE-2014-0835
Cross-site request forgery CSRF vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings...
CVE-2014-0835
Cross-site request forgery CSRF vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings...
CVE-2014-0835
IBM QRadar SIEM (7.2 MR1 and earlier) is affected by CVE-2014-0835, a Cross-Site Request Forgery that allows an attacker to hijack administrator authentication to modify Auto Update settings. The root cause centers on unauthorized changes to AutoUpdate configuration via CSRF without authenticatio...
CVE-2014-0835: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in IBM Security QRadar SIEM 7.2 MR1 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify console Auto Update settings...