CVE-2019-14411

CVE-2019-14411 affects cPanel prior to 78.0.2. The vulnerability arises because the DCV UAPI does not properly restrict demo accounts from writing to files, enabling an attacker to write to files via the DCV UAPI (SEC-473). Impact is implicit in the description: unauthorized file writes by demo a...

CVE-2019-14411

cPanel before 78.0.2 does not properly restrict demo accounts from writing to files via the DCV UAPI SEC-473...

CVE-2019-14405

CVE-2019-14405 affects cPanel prior to 78.0.18. The vulnerability allows demo accounts to execute code via securitypolicy.cg (SEC-487), enabling potential remote code execution with partial to high impact (per CVSS v2/v3: base scores 6.5/8.8). Affected software is cPanel; root cause details are n...

CVE-2019-14398

cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajaxmaketextsyntaxutil.pl SEC-498...

CVE-2019-14398

Summary (CVE-2019-14398) : cPanel prior to 80.0.5 contains an input validation/command-execution vulnerability in the ajax_maketext_syntax_util.pl component (SEC-498), enabling demo accounts to execute arbitrary code. The issue is exposed over network (no user interaction required) and has a high...

CVE-2019-14397

cPanel prior to 80.0.5 is affected by CVE-2019-14397. The vulnerability allows demo accounts to modify arbitrary files through the extractfile API1 call (SEC-496). Impact is limited to unauthorized file modifications on affected systems; no broader exploitation details are provided in the sources...

CVE-2019-14397

cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...

CVE-2019-12743

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Network Kits including self-hosted ones by brute-forcing the username after the /u/ initial URI substring, aka Response Discrepancy Information Exposure...

EspoCRM Trust Management Issue Vulnerabilities

EspoCRM is an open source web-based customer relationship management CRM system. The system provides features such as sales automation, community and customer support. EspoCRM is vulnerable to a trust management issue. An attacker can exploit this vulnerability to brute-force break a user's...

CVE-2019-10263

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account, it is possible to inject XSS in the Alias field, allowing the attacker to retrieve the admin's cookie and take over the account...

Good Twitter Samaritans accidentally prevent shoeshine scam

A few days ago, Indian news portals were buzzing with tales of a well-worn shoeshine scam making its way into social media. It’s a great example of how good-natured gestures can unwittingly aid scammers when we combine high-visibility accounts with potential lack of fact checking. Thankfully, it...

Schneider Electric Modicon Multiple Authentication Bypass Vulnerabilities (CVE-2018-7809; CVE-2018-7810; CVE-2018-7811)

Multiple authentication bypass vulnerabilities exist in Schneider Electric Modicon. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the affected page. Successful exploitation results in the attacker being able to change the password for...

How to steal a million (of your data)

Any user data — from passwords for entertainment services to electronic copies of documents — is highly prized by intruders. The reason is simply that almost any information can be monetized. For instance, stolen data can be used to transfer funds to cybercriminal accounts, order goods or service...

Slack Initiates Mass Password Reset

Popular workspace collaboration platform Slack is in the middle of asking tens of thousands of users to reset their passwords after a security breach. The move is actually in response to new information that has come to light regarding a 2015 compromise, when hackers infiltrated Slack’s networks ...

iOS URL Scheme Could Let App-in-the-Middle Attackers Hijack Your Accounts

Security researchers have illustrated a new app-in-the-middle attack that could allow a malicious app installed on your iOS device to steal sensitive information from other apps by exploiting certain implementations of Custom URL Scheme. By default on Apple's iOS operating system, every app runs...

How To Clear Out Your Zombie Apps and Online Accounts

All those services you signed up for but forgot about? They're a security risk. Here's how to get rid of them...

CVE-2019-12471

Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...

Unauthorized Access Vulnerability in CICMS v2.9

CICMS system is a php+mysql developed, CodeIgniter based enterprise building system. CICMS v2.9 suffers from an unauthorized access vulnerability, which can be exploited by attackers to create administrator accounts...

Win32k Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data;...

Unauthorized Access Vulnerability in TFXK.CMS System

Sichuan Tianfu Star Network Technology Co., Ltd. is an e-commerce platform construction and operation enterprise. Unauthorized access vulnerability exists in TFXK.CMS system, which allows attackers to arbitrarily add administrator accounts and leak data information...