CVE-2019-14366: Exposure of Sensitive Information to an Unauthorized Actor

WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

LavaLite CMS 5.7 Cross Site Scripting

Exploit Title: LavaLite CMS - 5.7 - Cross-Site Scripting Date: 09-10-2019 Exploit Author: Ismail Tasdelen Vendor Homepage: https://lavalite.org/ Software Link : https://github.com/LavaLite/cms Software : LavaLite CMS - v 5.7 Version : v 5.7 Vulernability Type : Cross-site Scripting Vulenrability ...

PT-2019-13646

Name of the Vulnerable Software and Affected Versions Slack-Chat versions 1.5.5 and earlier Description The issue allows an attacker to obtain a Slack Access Token from the source code, potentially revealing significant information about the victim's Slack environment, including channels and...

WP Intercom Slack <= 1.2.2 - Slack Access Token Disclosure

The Intercom plugin through 1.2.2 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

WP Slacksync < 1.8.6 - Slack Access Token Disclosure

The wpslacksync leaked a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

Donut - Generates X86, X64, Or AMD64+x86 Position-Independent Shellcode That Loads .NET Assemblies, PE Files, And Other Windows Payloads From Memory

Donut generates x86 or x64 shellcode from VBScript, JScript, EXE, DLL including .NET Assemblies files. This shellcode can be injected into an arbitrary Windows processes for in-memory execution. Given a supported file type, parameters and an entry point where applicable such as Program.Main, it...

ClamAV 0.102.0 - bytecode_vm Code Execution

ClamAV 0.102.0 - bytecodevm Code Execution !/usr/bin/python ''' Finished : 22/07/2019 Pu8lished : 31/10/2019 Versi0n : Current ./exploit.py clambc --debug exploit SNIP $ ''' names = 'test1', 'read', 'write', 'seek', 'setvirusname',...

ClamAV < 0.102.0 - 'bytecode_vm' Code Execution

!/usr/bin/python ''' Finished : 22/07/2019 Pu8lished : 31/10/2019 Versi0n : Current ./exploit.py clambc --debug exploit SNIP $ ''' names = 'test1', 'read', 'write', 'seek', 'setvirusname', 'debugprintstr', 'debugprintuint...

AtomShields Cli - Security Testing Framework For Repositories And Source Code

AtomShields Cli is a Command-Line Interface to use the software AtomShields Installation pip install atomshieldscli Basic usage ascli --target --name The allowed action values are: install : To install a checker or a report, depending the context setted. uninstall : To uninstall a checker or a...

Sandbox Breakout in realms-shim

Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting...

CVE-2019-13410

TOPMeeting before version 8.8 2019/08/19 shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page...

CVE-2019-13410

TOPMeeting before version 8.8 2019/08/19 shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page...

Information disclosure

TOPMeeting before version 8.8 2019/08/19 shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page...

CVE-2019-13410 TOPMeeting version before version 8.8 (2019/08/19) allows an attacker to obtain sensitive information

TOPMeeting before version 8.8 2019/08/19 shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page...

CVE-2019-13410

TOPMeeting vulnerability CVE-2019-13410 affects TOPMeeting versions before 8.8. The issue is information disclosure: attendees’ accounts and passwords are exposed on a front-end page; an attacker can obtain this by inspecting the page source. Root cause: sensitive credentials displayed in the cli...

CVE-2019-13410: Exposure of Sensitive Information to an Unauthorized Actor

TOPMeeting before version 8.8 2019/08/19 shows attendees account and password in front end page that allows an attacker to obtain sensitive information by browsing the source code of the page...

CVE-2017-15041

An arbitrary command execution flaw was found in the way Go's "go get" command handled the checkout of source code repositories. A remote attacker capable of hosting malicious repositories could potentially use this flaw to cause arbitrary command execution on the client side...

FortiSIEM external authentication password reflected in external authentication profile

An information exposure vulnerability in the external authentication profile form of FortiSIEM may allow an authenticated attacker to retrieve the external authentication password via the HTML source code.This could potentially aggravate attacks targeting the authenticated admin session, should...

Logic flaw vulnerability in Ruoyi's backend management system

Ruoyi backend management system is based on SpringBoot2.0 rights management system . A logic flaw vulnerability exists in the Ruoyi Backend Management System. An attacker can view the source code to obtain a username and password to log in to the backend...

Directory Traversal and Arbitrary File Download Vulnerabilities in MayiCMS (Ant Classification Information System)

MayiCMS Ant Classified Information System is a php mysql based website builder. Ant Classifieds Information System suffers from directory traversal and arbitrary file download vulnerabilities. An attacker can obtain sensitive information by traversing the directory and downloading website source...