CVE-2020-36176

The iThemes Security formerly Better WP Security plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs...

Microsoft Says SolarWinds Hackers Accessed Some of Its Source Code

Microsoft on Thursday revealed that the threat actors behind the SolarWinds supply chain attack were able to gain access to a small number of internal accounts and escalate access inside its internal network. The "very sophisticated nation-state actor" used the unauthorized access to view, but no...

Italy’s Ho-Mobile database with 2.5m accounts allegedly stolen, sold

By Sudais Asif Apparently, the personal data of over 2.5 million Ho-Mobile's customers is being sold on a dark web hacker forum. This is a post from HackRead.com Read the original post: Italys Ho-Mobile database with 2.5m accounts allegedly stolen, sold...

Tenda AC1200 Default Credentials Disclosure Vulnerability

The Tenda AC1200 is a wireless router from the Chinese company Tenda. A default credential disclosure vulnerability exists in the Tenda AC1200 Model AC6 15.03.06.51multi, which stems from the fact that admin, support, user, and nobody has a default password of 1234, which can be exploited by an...

CVE-2020-13473

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-13473

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-13474

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users...

CVE-2020-13474

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users...

Design/Logic Flaw

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file...

CVE-2020-13474

Affected software: NCH Express Accounts 8.24 and earlier. Vulnerability: an authenticated low-privilege user can craft a URL to access higher-privileged functionalities (e.g., Add/Edit users), indicating a privilege-escalation issue rooted in URL-based access control. Impact: as described, it ena...

CVE-2020-13474

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users...

CVE-2020-13473

CVE-2020-13473 affects NCH Express Accounts 8.24 and earlier. Local users can read the configuration file and recover the cleartext password, exposing confidential information (CVSS 3.1: LOCAL, HIGH confidentiality impact). The provided documents do not include remediation/patch details.

CVE-2020-13473

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file...

Privilege Escalation

odoo is vulnerable to privilege escalation. Insecure access controls allows remote authenticated users with access to contact management to modify user accounts, resulting in the attacker obtaining higher privileges...

NCH Express Accounts Security Vulnerability

NCH Express Accounts Accounting is a business accounting software. The software includes features such as financial income and expense management, financial analysis and reporting. A security vulnerability exists in NCH Express Accounts version 8.24 and prior versions that allows local users to...

NCH Express Accounts Security Vulnerability

NCH Express Accounts Accounting is a business accounting software. The software includes features such as financial income and expense management, financial analysis and reporting. A security vulnerability exists in NCH Express Accounts version 8.24, which originates when an authenticated,...

Egavilanmedia User Registration & Login System Cross-Site Request Forgery Vulnerability

Egavilanmedia User Registration & Login System is a management platform for user registration and login from Egavilanmedia, USA. A cross-site request forgery vulnerability exists in EgavilanMedia User Registration & Login System with Admin Panel 1.0, which allows to remotely obtain privileges to ...

DEBIAN-CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...

CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...

CVE-2019-11782

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with access to contact management to modify user accounts, leading to privilege escalation...