Home Owners Collection Management System 安全漏洞

A security vulnerability exists in the Home Owners Collection Management System, a homeowner collection management system, which can be exploited by attackers to compromise user accounts via a crafted POST request...

CVE-2021-38935

IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892...

CVE-2021-38935

IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 210892...

Librenms 跨站脚本漏洞

Librenms is a PHP and MySQL based open source network monitoring system from the Librenms community. The system features custom alerts, auto-discovery of network environments and automatic updates.Librenms suffers from a cross-site scripting vulnerability that stems from a lack of data validation...

in star7th/showdoc

Description There is a filter to prevent upload php, HTML, svg filetype in the code snippet from line 115 to line 122 in AttachmentController.class.php: if strstrstriptagsstrtolower$uploadFile'name', ".php" || strstrstriptagsstrtolower$uploadFile'name', ".htm" ||...

Hardcoded seed phrase in sherlock-v2-core repo

Handle cryptphi Vulnerability details Impact The hardcoded mnemonic can lead to account compromise. Proof of Concept There exists hardcoded credentials in line This credentials can be used to takeover the wallet address used. Tools Used Github Recommended Mitigation Steps Avoid hardcoding...

Phishers Rip Off High-Profile EA Gamers

Electronic Arts EA has attributed a recent series of takeovers of high-profile accounts of FIFA Ultimate Team players to “human error” within its customer experience team, some of whom apparently fell prey to a socially engineered phishing attack. After a number of top traders of FIFA’s Ultimate...

IBM Cognos Analytics has an unspecified vulnerability (CNVD-2021-94966)

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation. The software includes reports, dashboards and scorecards, and can help companies adjust their decisions by analyzing key factors and key people, etc. A security vulnerability exists in IBM Cognos Analytics,...

CVE-2021-20470

IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196339...

Hackers Using Compromised Google Cloud Accounts to Mine Cryptocurrency

Threat actors are exploiting improperly-secured Google Cloud Platform GCP instances to download cryptocurrency mining software to the compromised systems as well as abusing its infrastructure to install ransomware, stage phishing campaigns, and even generate traffic to YouTube videos for view cou...

PT-2021-7107 · Ldap +2 · Ldap +2

Name of the Vulnerable Software and Affected Versions: Tuleap versions prior to 13.2.99.83 Tuleap Enterprise Edition versions prior to 13.1-6 Tuleap Enterprise Edition versions prior to 13.2-4 Description: The issue exists due to improper sanitization of the search filter built from the ldap id...

Catalyst It Ltd Mahara Cms 代码问题漏洞

Catalyst It Ltd Mahara Cms is a fully featured electronic portfolio, blog, resume builder and social networking system from Catalyst It Ltd in New Zealand. Used to connect users and create online communities. A security vulnerability exists in Catalyst It Ltd Mahara Cms, which stems from the...

Verizon’s Visible Wireless Carrier Confirms Credential-Stuffing Attack

On Wednesday, Verizon’s Visible – an all-digital, uber-cheap wireless carrier – confirmed what customers have been complaining about on Reddit and Twitter all week: They lost control of their accounts; had their passwords and shipping addresses changed; and some got stuck with bills for pricey ne...

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in mineweb/minewebcms

Description Hello, In the password reset it is possible to perform a Host Header Injection, so the victim will receive an email pointing to a third party site. By clicking, the attacker will be able to retrieve the victim's account reset token and use it to access his account. From Portswigger :...

in star7th/showdoc

Description - CWE: CWE-288:Authentication Bypass Using an Alternate Path or Channel - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L , CVSS Score: 8.3High - Credit：Qianxin, Network Security Department, Product-Safety Team Unc1e In showdoc, there is a SSO process , DOC is shown in...

WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise

The plugin does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account. PoC User registration must be enabled or yo...

WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise

The plugin does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account. User registration must be enabled or you mu...

CVE-2021-20418

IBM Security Guardium 11.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 196279...

in aquilacms/aquilacms

✍️ Description Unauthenticated API function allows any user to change OR view another user first name, last name, password, and address information. As well, leaked activateAccountToken and resetPassToken can be viewed. 🕵️‍♂️ Proof of Concept The attacker can guess the correct MongoDBobject ID and...

Algolia: Information disclosure -> 2fa bypass -> POST exploitation

Greetings! So i was testing algolia.com. Impressed to find out that there are mitigations in place to prevent POST exploitation such as : When 2fa is enabled we need "old password" to update following things : - To update the password - To disable the 2fa, etc might more more.... And we need 2fa...