CVE-2021-39347

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save function found in the /includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases...

CVE-2021-39347 Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account Hijacking

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save function found in the /includes/admin/class-wc-stripe-admin-user-edit.php file that makes it possible for attackers to configure their account to use other site users unique STRIPE identifier and make purchases...

Mattermost: ABLE TO TRICK THE VICTIM INTO USING A CRAFTED EMAIL ADDRESS FOR A PARTICULAR SESSION AND THEN LATER TAKE BACK THE ACCOUNT

A vulnerability was found in a website that allowed an attacker to trick a victim into using a crafted email address for a particular session, leading to the attacker taking back the victim's account and accessing their private messages. The vulnerability was triggered by removing the email value...

3.1M Neiman Marcus Customer Card Details Breached

Dallas-based Neiman Marcus Group is known worldwide as the go-to luxury retailer for the well-heeled. But their reputation for impeccable quality just took a big hit with revelations that the company was breached by an attacker back in May 2020. It took 17 months for the retailer to notice. Just...

CVE-2021-41297 ECOA BAS controller - Insufficiently Protected Credentials-1

ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate privileges by disclosing credentials of administrative accounts in plain-text...

CVE-2021-41300

ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can access the page and obtain privilege with full functionality...

Session Fixation

zoneminder:edge is vulnerable to session fixation.As an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies between 3 and 5 is being generated when a user successfully logs in, and these sets...

Abstrium Pydio Cells 安全漏洞

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by French company Abstrium. A security vulnerability exists in Pydio Cells 2.2.9 that allows remote anonymous users to create standard users via the profile parameter...

GHSA-36MJ-6R7R-MQHF User can obtain JWT token even if account is disabled

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. Someone who never had an account cannot exploit this vulnerability. The fix ensures tokens are generated only for enabled...

CVE-2021-25960

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability Formula Injection. A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the...

Input validation

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability Formula Injection. A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the...

CVE-2021-25960 SuiteCRM - CSV Injection in Accounts Module

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability Formula Injection. A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the...

PT-2021-16884 · Suitecrm · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions 7.10.29 through 7.10.31 SuiteCRM versions 7.11.18 through 7.11.19 Description: The issue concerns a CSV Injection vulnerability, also known as Formula Injection, which allows a low-privileged attacker to inject payloads into...

Gamers Beware: Malware Hunts Steam, Epic & EA Origin Accounts

There’s a new cybersecurity threat to gamers: An advanced trojan, dubbed BloodyStealer, has emerged on underground forums and is being used to steal gamer accounts on various platforms, including Steam, Epic Games Store and EA Origin. Demand for stolen gamer data throughout the underground market...

SolarWinds Attackers Hit Active Directory Servers with FoggyWeb Backdoor

The threat actors behind the notorious SolarWinds supply-chain attacks have dispatched new malware to steal data and maintain persistence on victims’ networks, researchers have found. Researchers from the Microsoft Threat Intelligence Center MSTIC have observed the APT it calls Nobelium using a...

SharpSpray - Active Directory Password Spraying Tool. Auto Fetches User List And Avoids Potential Lockouts

SharpSpray is a Windows domain password spraying tool written in .NET C. Introduction SharpSpray is a C port of DomainPasswordSpray with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services. Features Can operate from inside and...

New BloodyStealer Trojan Steals Gamers' Epic Games and Steam Accounts

A new advanced trojan sold on Russian-speaking underground forums comes with capabilities to steal users' accounts on popular online video game distribution services, including Steam, Epic Games Store, and EA Origin, underscoring a growing threat to the lucrative gaming market. Cybersecurity firm...

Gila CMS Cross-Site Request Forgery Vulnerability (CNVD-2021-84283)

Gila CMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in Gila CMS version 1.11.4, which can be exploited by an attacker to arbitrarily add administrator accounts...

CVE-2020-20693

A Cross-Site Request Forgery CSRF in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts...

CVE-2020-20693

CVE-2020-20693 describes a Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 that allows authenticated attackers to arbitrarily add administrator accounts. The vulnerability is documented across multiple feeds (NVD entry CVE-2020-20693, RH Red Hat advisory, GHSA advisory, CNVD/CNNVD) and is as...