GrowthBook 路径遍历漏洞

GrowthBook is an open source feature markup and A/B testing platform from GrowthBook Open Source. A path traversal vulnerability exists in versions of GrowthBook prior to 2022-08-29, which stems from some self-hosted configurations, and can be exploited by an attacker to register a new account an...

Multiple user accounts via same email and username

Description Nakama console does not validate uppercase/lowercase letters when creating a new user. This can be abused to create multiple user accounts with same email and username. Proof of Concept HTTP Request 1 request POST /v2/console/user HTTP/1.1 Host: 192.168.1.16:7351 Authorization: Bearer...

CVE-2022-3099

creationtimestamp| type| source ---|---|--- 2022-09-03 20:40:22+00:00| seen| https://t.me/cibsecurity/49275 2024-01-29 09:15:37+00:00| seen| https://t.me/cultofwire/1186...

OESA-2022-1886 pcs security update

pcs is a corosync and pacemaker configuration tool. It permits users to easily view, modify and create pacemaker based clusters. Security Fixes: A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired passwords to login whe...

Exploit for CVE-2020-1472

ZeroLogon CVE-2020-1472 C++ version. This tool directly re...

Stripe: Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/

@mrasg discovered an improper access control issue in TaxJar. This could have allowed for account takeover using the email change functionality. The vulnerability was caused by not correctly validating whether or not the reset password token was connected to the user being reset and was resolved ...

British Airways customers targeted in lost luggage Twitter scam

Getting back into the travel habit? Jumping on a plane soon? Experienced a bit of a luggage disaster and looking for help on social media? Watch out, because a lack of prior research could prove very costly. Word has spread of a bogus Twitter account pretending to be a customer support channel of...

The vulnerability of the /etc/shadow.sample component of the TOTOLINK A810R router’s microprogramming system allows a intruder to gain increased privileges.

The vulnerability of the /etc/shadow.sample component of the TOTOLINK A810R router’s software lies in the use of pre-set user accounts. Exploiting this vulnerability could allow an attacker to gain increased privileges remotely...

CVE-2022-36521

Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...

Code injection

Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...

CVE-2022-36521

CVE-2022-36521 affects cskefu v7.0.1, where insecure permissions allow unauthenticated attackers to arbitrarily add administrator accounts. The issue is rooted in permission checks within the application, enabling privilege escalation at the admin-creation step. Multiple sources (NVD/Red Hat/CVE ...

CVE-2022-36521

Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...

CVE-2022-36521

Insecure permissions in cskefu v7.0.1 allows unauthenticated attackers to arbitrarily add administrator accounts...

Cross site request forgery (csrf)

mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily add user accounts and modify user information...

CVE-2021-39394

CVE-2021-39394 affects mm-wiki v0.2.1, where a Cross-Site Request Forgery (CSRF) allows an attacker to arbitrarily add user accounts and modify user information. The NVD entry lists CVSS‑3.1 base score 6.5 (Medium) with network vector, low attack complexity, no privileges required, but user inter...

Iranian APT’s new data extraction tool Hyperscrape

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Charming Kitten, an Iranian government-backed threat group, has been employing a new data extraction tool, HYPERSCAPE. It has been used to retrieve data from Microsoft Outlook, Yahoo, and Gmail accounts...

Hackers Breach LastPass Developer System to Steal Source Code

Password management service LastPass confirmed a security incident that resulted in the theft of certain source code and technical information. The security breach is said to have occurred two weeks ago, targeting its development environment. No customer data or encrypted passwords were accessed,...

cskefu 访问控制错误漏洞

cskefu Chunsong Customer Service is an open source, free intelligent customer service system open source by China Chatopera. A security vulnerability exists in cskefu version v7.0.1, which stems from an insecure permission restriction. An attacker exploiting this vulnerability can arbitrarily add...

PT-2022-23442 · Cskefu · Cskefu

Name of the Vulnerable Software and Affected Versions: cskefu version 7.0.1 Description: The issue is related to insecure permissions, allowing unauthenticated attackers to add administrator accounts arbitrarily. Recommendations: For cskefu version 7.0.1, update to a version that addresses the...

Okta Hackers Behind Twilio and Cloudflare Attacks Hit Over 130 Organizations

The threat actor behind the attacks on Twilio and Cloudflare earlier this month has been linked to a broader phishing campaign aimed at 136 organizations that resulted in a cumulative compromise of 9,931 accounts. The activity has been condemned 0ktapus by Group-IB because the initial goal of the...