CVE-2019-17564

creationtimestamp| type| source ---|---|--- 2020-04-02 02:28:19+00:00| seen| https://t.me/cibsecurity/10921 2021-08-02 20:29:04+00:00| published-proof-of-concept| Telegram/Tvd8QL4SENBdyhrOX8ClGh5gThmxL9slOp2aXg1VdaPgg 2023-11-24 22:14:24+00:00| seen| https://t.me/arpsyndicate/546 2023-12-18...

CyberArk PSMP 10.9.1 - Policy Restriction Bypass

CyberArk PSMP 10.9.1 - Policy Restriction Bypass Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass Google Dork: NA Date: 2020-02-25 Exploit Author: LAHBAL Said Vendor Homepage: https://www.cyberark.com/ Software Link: https://www.cyberark.com/ Version: PSMP = 11.1 Prerequisites Poli...

CyberArk PSMP 10.9.1 - Policy Restriction Bypass

Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass Google Dork: NA Date: 2020-02-25 Exploit Author: LAHBAL Said Vendor Homepage: https://www.cyberark.com/ Software Link: https://www.cyberark.com/ Version: PSMP = 11.1 Prerequisites Policy allows us to overwrite PSMRemoteMachine...

Gitlab -- Vulnerability

Gitlab reports: Email Confirmation not Required on Sign-up...

CVE-2020-0063

In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143128911...

Design/Logic Flaw

In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143128911...

CVE-2020-0063

In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143128911...

CVE-2020-0063

CVE-2020-0063 affects Android SurfaceFlinger, where the UI confirmation screen protected by the TEE can be overridden, enabling local elevation of privilege. Root cause: manipulation of the UI flow in SurfaceFlinger allows bypassing user interaction. Impact: local privilege escalation with high s...

cirugiaycirujanos.com Cross Site Scripting vulnerability

Security Researcher g0bl1nsec Helped patch 3608 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting cirugiaycirujanos.com website and its users. Following...

The vulnerability in the `createImageBitmap` function of Firefox browsers, Firefox ESR, and the Thunderbird email client, related to a data source confirmation error, allows attackers to disclose protected information.

The vulnerability of the createImageBitmap function in Firefox, Firefox ESR, and the Thunderbird email client involves reading images from various sources, which violates the company’s policies. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...

Nord Security: Unauthorized User Can Delete Any User Account

DESCRIPTION: Your help desk allows creating tickets by email. Which means the user can send an email to the NordVPN support email to a add a new ticket to his activities. So when you send an email to [email protected] from your email address, this ticket will be created on the account that you...

Monero: Monero wallet password change is confirmed when not matching

Summary: If you change your wallet password in gui, the confirmation does not need to match the new password. Releases Affected: list each version and OS of the application affected list each version and OS of the application affected Steps To Reproduce: Open your wallet. Go to settings. Change...

tarcisiodelgadoblog.com.br Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1097332 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

ehome.co.za Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1095480 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

chemicalshoppe.com Cross Site Scripting vulnerability

Security Researcher ELProfesor Helped patch 2738 vulnerabilities Received 8 Coordinated Disclosure badges Received 105 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting chemicalshoppe.com website and its users. Following...

The vulnerability of the Firefox browser’s Upgrade-Insecure-Requests specification, related to a data source confirmation error, allows a hacker to access confidential data and compromise its integrity.

The vulnerability of the Upgrade-Insecure-Requests specification in the Firefox browser is related to a data source confirmation error. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

The vulnerability of Firefox browser, related to incorrect application installation when pressing the ALT + a keys on the keyboard, allows the attacker to compromise data integrity.

The vulnerability of Firefox browsers is related to the incorrect installation of extensions when pressing the ALT + a keys on the keyboard. This allows extensions to be installed without user confirmation. Exploiting this vulnerability can enable an attacker to compromise data integrity remotely...

Shopify: Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation

Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email Confirmation Summary This report is based on the scenario that email confirmation has been bypassed already, like shown in 791775. What happened in 791775 was, I was too excited and didn't take a step...

Shopify: [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation

Summary In 791775, I submitted a bug at Sunday 5pm Canada time, it was triaged two hours later, and I got the temp fix message at around 3am the next day in Canada time. Truly awesome, the next day I retested after the first fix, and found that I - Cannot receive the email confirmation in the ema...

Shopify: Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSO

I told Pete I would take a look at Spotify, hi Pete. Summary It's possible to take over any store account through bypassing the email confirmation step in .myshopify.com. I found a way to confirm arbitrary emails, and after confirming arbitrary email in .myshopify.com, user is able to integrate...