CVE-2023-42551

Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

CVE-2023-42550

Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

CVE-2023-42550

Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

CVE-2023-42548

Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

CVE-2023-42546

Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

CVE-2022-39038

Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service...

Authentication flaw

Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of the user account to acquire arbitrary account privilege, and access, manipulate system or disrupt service...

CVE-2022-39038

The CVE concerns Flowring Technology’s Agentflow BPM Enterprise Management System. Affected component: improper authentication that allows a remote attacker with general user privileges to rename a user account, enabling arbitrary account privilege escalation and potential to access, manipulate, ...

Zapier 安全漏洞

Zapier is a product of Zapier, Inc. that allows end users to integrate the We b applications they use and automate workflows. A security vulnerability exists in versions of Zapier prior to 2022-08-17 that stems from code written to allow in-account privilege escalation. An attacker exploited the...

PT-2022-4144 · Intel · Intel Datacenter Group Event Android Application

Name of the Vulnerable Software and Affected Versions: IntelR Datacenter Group Event Android application, all versions Description: The issue is related to uncontrolled search path elements in the IntelR Datacenter Group Event Android application. This may allow an authenticated user to potential...

PVS Wizard fails to connect to Cloud

In the process of using a PVS Wizard, after entering your credentials to connect to Citrix Cloud, you might see this error: "Cannot connect to the Citrix Virtual Desktops Controller at : Citrix Virtual Desktops FullAdmin or MachineAdmin permission required." Following the below steps 1. If Remote...

HackerOne: Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs

Hello, Hope you are doing well, SUMMARY -In hackerone user doesn't have permission to do any action like "disclosing/undiclosing" in disclosed report. -Here user can send the "cancel-disclosure-request" request to the server and server accepts the request gave 200ok response with ""flash":"The...

CVE-2021-2000

Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having SYS Account privilege with network access via Oracle Net to compromise Unified...

ABB VSN300 WiFi Logger Card and VSN300 WiFi Logger Card for React Privilege Access Control Vulnerability

The ABB VSN300 WiFi Logger Card and the VSN300 WiFi Logger Card for React are both wireless data logger card products from Asea Brown Boveri ABB, Switzerland. A security vulnerability exists in the ABB VSN300 WiFi Logger Card and VSN300 WiFi Logger Card for React, which stems from the program...

ATutor 2.2 PHP Code Injection

--------------------------------------------------------------- ATutor "name" 186. 187. $sort = '$grades'.$ordercol.', SORT'.strtoupper$order.', $selectedstudents ... 188. 189. foreach$selectedtests as $test 190. 191. if $test"gradebooktestid" $ordercol 192. $sort .= ',...

用友软件旗下一网站存在一个Struts2漏洞可拿服务器

简要描述： 用友软件旗下一网站存在一个Struts2漏洞可拿服务器。主要因为漏洞不及时打上，账户权限过大。 详细说明： 今天闲来无事，在网上随意点了几下，发下了个漏洞。 存在漏洞的网址：http://pu.yonyouup.cn/login!loginIndexPage.action 漏洞证明： 首先，这是存在漏洞的网页：http://pu.yonyouup.cn/ 点进去后，会跳转到http://pu.yonyouup.cn/login!loginIndexPage.action ，于是我就猜想，是不是存在Struts2漏洞呢？就试了一下。 结果如图：...

Modern sky any order unauthorized modifications-vulnerability warning-the black bar safety net

I heard that modern sky sent the tickets, get to. Require the year tickets! Norman Jade on! Goddess! I'm coming! （Vulnerability demonstration using your own test account, the story is this, there once was a handsome than the and an ugly ratio. A handsome than buying a heavens laugh, the shipping...

CVE-2006-4082

Barracuda Spam Firewall BSF, possibly 3.3.03.053, contains a hardcoded password for the admin account for logins from 127.0.0.1 localhost, which allows local users to gain privileges...

Oracle Forms 6i9i4.5.105.06.0.810g Services - Unauthorized Form Execution

Oracle Forms 6i9i4.5.105.06.0.810g Services - Unauthorized Form Execution source: https://www.securityfocus.com/bid/14319/info Oracle Forms Services is susceptible to an unauthorized form execution vulnerability. Attackers may exploit this vulnerability to execute arbitrary commands with the...

Default Password (debug) for 'super' Account

The account 'super' on the remote host has the password 'debug'. An attacker may use it to gain further privileges on this system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "super"; password = "debug"; include'deprecatednasllevel.inc'; include'compat.inc'; if description...