CVE-2024-37765

Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page...

Machform Security Vulnerabilities

Machform is an online questionnaire program. A security vulnerability exists in Machform version 19 and prior versions that originates from an authenticated blind SQL injection in the user account settings page...

MAL-2024-1722 Malicious code in account-settings (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

Dropbox Discloses Breach of Digital Signature Service Affecting All Users

Cloud storage services provider Dropbox on Wednesday disclosed that Dropbox Sign formerly HelloSign was breached by unidentified threat actors, who accessed emails, usernames, and general account settings associated with all users of the digital signature product. The company, in a filing with th...

Hospital Management System 1.0 Cross Site Scripting

Exploit Title: Hospital Management System - Stord XSS Google Dork: N/A Application: Hospital Management System Date: 27.02.2024 Bugs: Stord XSS Exploit Author: SoSPiro Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Liferay Portal and Liferay DXP Security Vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

GHSA-XQ4R-4XFH-VCH8 Liferay Portal and Liferay DXP vulnerable to theft of hashed password

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password...

Default credentials

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password...

CVE-2024-26270

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password...

CVE-2024-26270

The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle attackers to steal a user's hashed password...

OpenReplay Security Vulnerabilities

OpenReplay is developer-friendly, self-hosted session replay. A security vulnerability exists in OpenReplay version 1.14.0 and prior releases that stems from a lack of validation of Name field-Account Settings, which allows an attacker to send an email with HTML injection code to a victim...

Malicious code in @zettle-bo/account-settings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b17c84d8882d13329dffcb79f072da64a52b32b63fb3e8ba5a30daaec4e69a57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-30123

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting XSS in the Member Center, Account Settings...

Cross site scripting

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting XSS in the Member Center, Account Settings...

CVE-2023-30123

CVE-2023-30123 affects wuzhicms v4.1.0, with a reported Cross Site Scripting (XSS) vulnerability in the Member Center, Account Settings. The vulnerability is documented with a CVSSv3.1 base score of 5.4 (MEDIUM) and an attacker may require user interaction to exploit. A connected PT-Security advi...

PT-2023-22546 · Wuzhicms · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: wuzhicms version 4.1.0 Description: The issue is related to Cross Site Scripting XSS in the Member Center, Account Settings. Recommendations: For wuzhicms version 4.1.0, as a temporary workaround, consider restricting access to the Member...

CVE-2023-30123

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting XSS in the Member Center, Account Settings...

CVE-2023-30123

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting XSS in the Member Center, Account Settings...

CVE-2023-30123

wuzhicms v4.1.0 is vulnerable to Cross Site Scripting XSS in the Member Center, Account Settings...

Design/Logic Flaw

In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is...