U.S. Dept Of Defense: Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]

The website had a directory that lacked authentication, allowing an attacker to add a new admin user and change the privileges of existing users without any authentication...

Devise-Two-Factor vulnerable to brute force attacks

Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. Impact If a...

CVE-2023-6912

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords...

CVE-2023-6689 Cross-Site Request Forgery in EFACEC BCU 500

A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative account, a CSRF attack could compromise the entire web application...

CVE-2023-28017

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal...

Cross site scripting

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which leads to executing malicious script code. This may let the attacker steal...

PT-2023-21483 · Hcl · Hcl Connections

Name of the Vulnerable Software and Affected Versions: HCL Connections affected versions not specified Description: The issue allows an attacker to execute arbitrary script code in the browser of an unsuspecting user after visiting a vulnerable URL, leading to the execution of malicious script...

The vulnerability of the GLPI system for requests, incidents, and inventory management, related to insufficient access control, allows a malicious user to gain unauthorized access to another user’s account.

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to another user’s account...

CVE-2023-37533

HCL Connections is vulnerable to reflected cross-site scripting XSS where an attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user after visiting the vulnerable URL which contains the malicious script code. This may allow the attacker to steal...

CVE-2023-29974

An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements...

PT-2023-26011 · Hcl · Hcl Connections

Name of the Vulnerable Software and Affected Versions: HCL Connections affected versions not specified Description: The issue is related to reflected cross-site scripting XSS, where an attacker can execute arbitrary script code in the browser of an unsuspecting user after visiting a vulnerable UR...

PT-2023-22499 · Unknown · Pfsense Ce

Name of the Vulnerable Software and Affected Versions: Pfsense CE version 2.6.0 Description: An issue in Pfsense CE allows attackers to compromise user accounts due to weak password requirements. Recommendations: For Pfsense CE version 2.6.0, consider strengthening password requirements to preven...

Home Assistant vulnerable to account takeover via auth_callback login

Part of the Cure53 security audit of Home Assistant. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-41893

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

Design/Logic Flaw

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

PT-2023-26000 · Hcl · Hcl Compass

Name of the Vulnerable Software and Affected Versions: HCL Compass affected versions not specified Description: HCL Compass is vulnerable to insecure password requirements. An attacker could easily guess the password and gain access to user accounts. Recommendations: At the moment, there is no...

Dependabot impersonators cause trouble on GitHub

GitHub is experiencing issues of the "breached account and malicious code" variety. ITPro reports that unnamed individuals have been compromising accounts and using them to install malware capable of password theft. Its a fairly elaborate scam which even includes imitation of GitHubs popular...

Multiple Stored XSS Found

Description Stored XSS Cross-Site Scripting is a type of web security vulnerability caused by improper input validation and inadequate data sanitization in a web application. It occurs when an attacker injects malicious scripts usually in the form of HTML or JavaScript into a website's database o...

CVE-2023-26451

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts...

Code injection

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering...