CVE-2022-40287

The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting XSS vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account...

CVE-2022-40289

PHP Point of Sale (version 19.0) is affected by an authenticated Stored Cross-Site Scripting (XSS) in the upload/download functionality. The underlying issue allows an attacker to escalate privileges or compromise accounts of users who observe the targeted files. The reports consistently describe...

CVE-2022-40288

The CVE-2022-40288 entry refers to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in PHP Point of Sale, specifically affecting version 19.0 by PHP Point of Sale, LLC. The flaw resides in user profile data fields and can be leveraged to escalate privileges within the application ...

PT-2022-25322 · Php Point Of Sale Llc +1 · Php Point Of Sale

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The application is vulnerable to an authenticated Stored Cross-Site Scripting XSS issue in its messaging functionality. This could lead to privilege...

PT-2022-25323 · Php Point Of Sale Llc +1 · Php Point Of Sale

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The application is vulnerable to an authenticated Stored Cross-Site Scripting XSS issue in the user profile data fields. This could be used to escalate privileges within the...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

CVE-2022-3741

CVE-2022-3741 affects chatwoot/chatwoot and is described as an improper restriction of excessive authentication attempts. The connected documents provide concrete details: the issue enables DoS via account generation under resource constraints, with the ability to identify output Status Codes to ...

PT-2022-23980 · Chatwoot +1 · Chatwoot +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue affects account generation and sign-in directories. It may be possible to create a denial-of-service DoS event in the server by generating...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

CVE-2022-3741 Improper Restriction of Excessive Authentication Attempts in chatwoot/chatwoot

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

Credential stuffers take aim at Final Fantasy XIV players

Square Enix, the company behind video games like Final Fantasy XIV, reports that a third party is attempting to gain access to its Account Management System. How is this happening, and what are the risks? More importantly, what do you need to do to ensure your accounts are safe from harm?...

Developer account body snatchers pose risks to the software supply chain

Over the past several years, high-profile software supply chain attacks have increased in frequency. These attacks can be difficult to detect and source code repositories became a key focus of this research. Developer account takeovers present a substantial risk to the software supply chain becau...

CVE-2022-3255 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

GHSA-QCQV-38JG-2R43 Pageflow vulnerable to insecure direct object reference in membership update endpoint

Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to including their own. While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending...

Pageflow vulnerable to insecure direct object reference in membership update endpoint

Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the manager role to including their own. While the Entity dropdown select field is greyed out in the UI, an attacker can use tools which allow sending...

CVE-2022-36073

RubyGems.org (the RubyGems host) is affected by CVE-2022-36073 due to a bug in the password and email change confirmation flow that lets an attacker change an account’s email to an unowned address. This could enable the attacker to access saved API keys and, after an authenticated user resets the...

PYSEC-2022-250

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-250

The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-251

The spam project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...

PYSEC-2022-252

The deep-translator project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time...