3084 matches found
Privilege escalation
In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability in the picture upload point of "packageedit.php" file...
PUB-A-208279300
In recycle of Parcel.java, there is a possible way to start foreground activity from background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2022-29633
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie...
CVE-2022-29633
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie...
CVE-2022-29633
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie...
Design/Logic Flaw
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie...
CVE-2022-29633
Linglong v1.0 has an access-control bypass where a crafted cookie grants access to the application's background. Veracode attributes the root cause to a hard-coded JWT in jwt.go, enabling cookie forging. Exploitation is feasible over the network via crafted cookies, granting unauthorized access t...
CVE-2022-29633: Undefined Security Weakness
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie...
PT-2022-19740 · Linglong · Linglong
Name of the Vulnerable Software and Affected Versions: Linglong version 1.0 Description: An access control issue allows attackers to access the background of the application via a crafted cookie. Recommendations: For Linglong version 1.0, consider restricting access to sensitive areas of the...
GHSA-XM59-JVXM-CP3V mxGraph vulnerable to cross-site scripting in color field
mxGraph through 4.0.0, related to the draw.io Diagrams plugin before 8.3.14 for Confluence and other products, is vulnerable to cross-site scripting. draw.io Diagrams allows the creation and editing of draw.io-based diagrams in Confluence. Among other things, it allows to set the background color...
Tetanus - Mythic C2 Agent Targeting Linux And Windows Hosts Written In Rust
Tetanus is a Windows and Linux C2 agent written in rust. Installation To install Tetanus, you will need Mythic set up on a machine. In the Mythic root directory, use mythic-cli to install the agent. payload start tetanus" sudo ./mythic-cli install github https://github.com/MythicAgents/tetanus su...
Friday Squid Blogging: Squid Filmed Changing Color for Camouflage Purposes
Video of oval squid Sepioteuthis lessoniana changing color in reaction to their background. The research paper claims this is the first time this has been documented. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog...
CVE-2022-28552
Cscms 4.1 is vulnerable to SQL Injection. Log into the background, open the song module, create a new song, delete it to the recycle bin, and SQL injection security problems will occur when emptying the recycle bin...
Video Conferencing Apps Sometimes Ignore the Mute Button
New research: "Are You Really Muted?: A Privacy Analysis of Mute Buttons in Video Conferencing Apps": Abstract: In the post-pandemic era, video conferencing apps VCAs have converted previously private spaces -- bedrooms, living rooms, and kitchens -- into semi-public extensions of the office. And...
CVE-2022-29418
Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: pagesettingenable-me, pagesettingbg-color, pagesettingtxt-color, pagesettinganccolor...
WS-2022-0201
Improper Privilege Management - receptionist can view background services and log for admin in openemr/openemr before 7.0.0...
CVE-2022-28445
KiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background management module...
CVE-2022-28445
KiteCMS v1.1.1 was discovered to contain an arbitrary file read vulnerability via the background management module...
