CVE-2020-29392

The Estil Hill Lock Password Manager Safe app 2.3 for iOS has a 06 backdoor password. An attacker with physical access can unlock the password manager without knowing the master password set by the user...

CVE-2020-25473

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

CVE-2020-25473

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

CVE-2020-25475

SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action...

Sql injection

SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action...

CVE-2020-25475

SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action. The linked documents confirm an SQL injection vulnerability in this product/version, caused by unsafely handling the id input in the editNews workflow. The CVE notes a SQL injection...

CVE-2020-25474

CVE-2020-25474 affects SimplePHPscripts News Script PHP Pro 2.3. The connected sources describe a Cross-Site Scripting (XSS) vulnerability exploitable via the editor_name parameter. Affected component is the News Script PHP Pro 2.3 software; no root cause details are provided beyond the XSS via e...

CVE-2020-25474

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting XSS vulnerability via the editorname parameter...

CVE-2020-25473

CVE-2020-25473 affects SimplePHPscripts News Script PHP Pro 2.3. The root cause is that HttpOnly is not set on session cookies, potentially exposing session data to client-side access. The NVD notes a network attack vector with low complexity and no authentication required, leading to partial con...

CVE-2020-25473

SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies...

The Wisconsin GOP Lost $2.3 Million in an Email Scam

Trump's website gets hacked, a ransomware group calls it quits, and more of the week's top security news...

CVE-2020-15849

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

Unrestricted file upload

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15488

Re:Desk 2.3 allows insecure file upload...

CVE-2020-15488

CVE-2020-15488 affects Re:Desk 2.3 and is described as an insecure file upload vulnerability. Public records note this CVE with an NVD entry (NVD: CVE-2020-15488) and related references; associated scores indicate CVSS v2 base 5.0 (Medium) and CVSS v3.1 base 7.5 (High) with network access and low...

Sql injection

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution i...

CVE-2020-15487

Re:Desk 2.3 contains a blind unauthenticated SQL injection in getBaseCriteria() (protected/models/Ticket.php). By altering the folder GET parameter in a crafted URL, arbitrary SQL can be executed, enabling unauthenticated remote command execution via a bizRule eval() in yii/framework/web/auth/CAu...