1830 matches found
Acronis: Account Confirmation bypass leads to acess some fucntionality
STEPS: 1. Go to the URL https://account.acronis.com//auth/signup 2. Create a Business Account 3. Intercept the request using burp suite 4. Now intercept the response of given HTTP REQUEST below 5. Change the field "confirmed":false to true 6. Even you can bypass Accept term condition by changing...
CVE-2021-27931
creationtimestamp| type| source ---|---|--- 2021-03-03 22:45:43+00:00| seen| https://t.me/cibsecurity/24429 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-27931.yaml 2025-01-26 00:00:00+00:00| seen| The Shadowserver...
Release information for Veeam Service Provider Console v5
A newer version of Veeam Service Provider Console is available, review Veeam for service providers: Download for more information. Requirements Please confirm that you are running version 4 build 4.0.0.4877 or later prior to upgrading. You can check this under Configuration | Support Information ...
PT-2021-17521 · Mitre · Mitreid Connect
Name of the Vulnerable Software and Affected Versions: MITREid Connect versions through 1.3.3 Description: The OpenID Connect server implementation for MITREid Connect contains a Mass Assignment vulnerability, also known as Autobinding. This issue arises due to the unsafe usage of the...
CS Money: Html injection on subscription email
Vulnerability description not provided...
CVE-2021-25323
The default setting of MISP 2.4.136 did not enable the requirements aka requirepasswordconfirmation to provide the previous password when changing a password...
CVE-2021-0306
In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which allows an app to gain the android.permission.ACTIVITYRECOGNITION permission without user confirmation. This could lead to local escalation of privilege with no...
Engel & Völkers Technology GmbH: Blind SSRF on infodesk.engelvoelkers.com via proxy.php
Summary: The application has a proxy.php file which basically accepts a parameter via url query parameter and passes it to fopen. However, it doesn't validate the parameter value prior to passing it to fopen- making it possible to influence what's being done. That said, because of code following...
Automattic: [sub.wordpress.com] - XSS when adjust block Poll - Confirmation Message - On submission:Redirect to another webpage - Redirect address:[xss_payload]
Summary: Dear Wordpress Team, Today when I tried to create a post with block "Poll" and I have found at Poll Block - Confirmation Message - On submission:Redirect to another webpage and Redirect address:xsspayload At Redirect address line, I can save the javascript:alertdocument.cookie as an URL...
Profile Builder & Profile Builder Pro < 3.3.3 - Authenticated Blind SQL Injection
The orderby parameter of the wp-admin/users.php?page=unconfirmedemails=email=asc page, which is available when the "Email confirmation" setting of the plugin is activated default is off, is not properly sanitised and validated before being concatenated in a SQL statement, leading to an SQL...
CVE-2020-8539
creationtimestamp| type| source ---|---|--- 2020-12-01 20:54:10+00:00| seen| https://t.me/cibsecurity/16999 2021-04-23 13:33:46+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/post/android/local/koffee.rb 2025-02-06 03:13:44+00:00| seen|...
Michael Ellis as NSA General Counsel
Over at Lawfare, Susan Hennessey has an excellent primer on how Trump loyalist Michael Ellis got to be the NSA General Counsel, over the objections of NSA Director Paul Nakasone, and what Biden can and should do about it. While important details remain unclear, media accounts include numerous...
Home Depot Confirms Data Breach in Order Confirmation SNAFU
Home Depot has exposed the private order confirmations of hundreds of Canadian consumers, containing names, physical addresses, email addresses, order details and partial credit-card information. After customers began reporting that they had received hundreds of emails from the home-improvement...
Synology SRM lbd service Command Execution Vulnerability
Summary An exploitable command execution vulnerability exists in the lbd service functionality of Qualcomm lbd 1.1, as present in Synology SRM 1.2.3 RT2600ac 8017-5. A specially crafted debug command can overwrite arbitrary files with controllable content, resulting in remote code execution. An...
council82.org Cross Site Scripting vulnerability OBB-1456052
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
nl.outofservice.com Cross Site Scripting vulnerability OBB-1453606
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Exploit for Cross-site Scripting in Olimpoks Olimpok
CVE-2020-16270 Suggested description: OLIMPOKS under 3...
GitLab Resource Management Error Vulnerability (CNVD-2020-63397)
GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. A security...
