84 matches found
CVE-2020-14205
The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker may leverage this issue to manipulate the integrity of dive logs...
CVE-2020-14205
affected software: WordPress DiveBook plugin 1.1.4; vulnerability: improper access control in the Log Dive form due to missing authorization checks; impact: could allow an attacker to manipulate the integrity of dive logs. root cause: failure to perform authorization checks on log dive submission...
WordPress plugin 访问控制错误漏洞
WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Give is a fundraising platform plugin used in it.relevant is a relevant content display plugin used in it. A security...
dive-with-chris-and-ralf.de Cross Site Scripting vulnerability OBB-1450059
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Intel SGX and Processor Side Channel Data Leakage Vulnerabilities - Lenovo Support US
No description provided...
Ewon Flexy IoT Router. A Deep dive
First off I would like to thank the techs at PTP for their insights and help during this process. I know what I know, and I don't know what I don’t know, so I asked for help sometimes. I've learned a lot from this project e.g. how XOR works, and how to use IDA to analyse ARM binaries better, so I...
divecenterforsale.com XSS vulnerability
Open Bug Bounty ID: OBB-657016 Description| Value ---|--- Affected Website:| divecenterforsale.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Diving Log 6.0 - XML External Entity Injection
Exploit Title: Diving Log 6.0 XXE Injection + Date: 27-11-2017 + Exploit Author: Trent Gordon + Vendor Homepage: http://www.divinglog.de + Software Link: http://www.divinglog.de/english/download/ + Disclosed at: https://thenopsled.com/divinglog.txt + Version: 6.0 + Tested on: Windows 7 SP1,...
dive-arena.ru Open Redirect vulnerability
Open Bug Bounty ID: OBB-401600 Description| Value ---|--- Affected Website:| dive-arena.ru Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet Vulnerab...
Blackware Dive Assistant XML External Entity Injection Vulnerability
Blackware Dive Assistant desktop version is a suite of dive assistant software from Blackware UK. The software is used to record, analyze and plan dive tools, dive tables etc. An XML external entity injection vulnerability exists in version 8.0 of Blackware Dive Assistant Desktop Edition. A remot...
CVE-2017-8918
XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file...
Design/Logic Flaw
XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file...
CVE-2017-8918
XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file...
CVE-2017-8918
XXE in Blackwave Dive Assistant – Desktop Edition 8.0 (Dive Assistant Template Builder) allows an attacker to view local files via a crafted template.xml. The vulnerability is XML External Entity (XXE) injection in the template builder that processes XML templates, enabling local-file disclosure....
CVE-2017-8918
XXE in Dive Assistant - Template Builder in Blackwave Dive Assistant - Desktop Edition 8.0 allows attackers to remotely view local files via a crafted template.xml file...
Dive Assistant Template Builder 8.0 - XML External Entity Injection
Dive Assistant Template Builder 8.0 - XML External Entity Injection + Exploit Title: Dive Assistant - Template Builder XXE Injection + Date: 12-05-2017 + Exploit Author: Trent Gordon + Vendor Homepage: http://www.blackwave.com/ + Software Link:...
Dive Assistant Template Builder 8.0 - XML External Entity Injection
Exploit Title: Dive Assistant - Template Builder XXE Injection + Date: 12-05-2017 + Exploit Author: Trent Gordon + Vendor Homepage: http://www.blackwave.com/ + Software Link: http://www.diveassistant.com/Products/DiveAssistantDesktop/index.aspx + Version: 8.0 + Tested on: Windows 7 SP1, Windows...
Tuscany Dive - Native code usage, Possible privilege escalation, SD-card access vulnerabilities
HackApp vulnerability scanner discovered that application Tuscany Dive published at the 'play' market has multiple vulnerabilities...
Heroku API Deep Dive Script Insertion
Document Title: =============== Heroku API Deep Dive Bug Bounty 3 - Persistent UI Vulnerability References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=1398 BugCrowd ID: 6b37910a3c5685b944a3ad65068aa251af47450953a06b8b13d74b35d708f6b0 Acknowledgement Hall of Fame:...
CVE-2014-6913
The Dive The World aka com.paperton.wl.divetheworld application 1.53 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...