CubeCart 3.0.12 - Multiple Vulnerabilities

CubeCart 3.0.12 - Multiple Vulnerabilities CubeCart Multiple Vulnerabilities Vendor: Devellion Limited Product: CubeCart Version: = 3.0.12 Website: http://www.cubecart.com BID: 19782 CVE: CVE-2006-4525 OSVDB: 28279 28280 28281 SECUNIA: 21659 Description: CubeCart is a very popular web application...

CubeCart < 3.0.12 - Multiple Vulnerabilities

CubeCart Multiple Vulnerabilities Vendor: Devellion Limited Product: CubeCart Version: = 3.0.12 Website: http://www.cubecart.com BID: 19782 CVE: CVE-2006-4525 OSVDB: 28279 28280 28281 SECUNIA: 21659 Description: CubeCart is a very popular web application written in php that allows for an individu...

The vulnerability of the Internet Explorer browser allows a perpetrator to trick users into creating a TCP connection with a limited port.

The vulnerability of Internet Explorer is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to remotely trick users into establishing a TCP connection with a limited port, through a specially crafted web page...

Nextcloud: XSS on IOS app via HTML rendering

@bugdiscloseguys reported an issue to us leading to a stored XSS attack on the iOS app. To be exploitable the victim would have to open a malicious file shared by an adversary with the user. On request of the reporter, this issue is only disclosed limitedly. While we usually don't agree to disclo...

Shopify: Read access to hidden orders,products,customers etc. by limited access Staff member through reference page in Comments (Information disclosure )

Hi Team , Note : I have reported multiple issues related to information which were closed a N/A due to some information lack. But this issue will look similar by title but it's different then other issues. Before testing anything i have insured that all other permissions are limited for the accou...

moorings.co.uk XSS vulnerability

Vulnerable URL:...

Uber: newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf

Limited disclosure @jamesclyde's request...

The vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability in GDI+, related to the processing of specially crafted images, allows for remote execution of code provided that the user opens a specially crafted image. Exploiting this vulnerability enables a malicious individual to gain full control over the system. They can then install...

Uber: Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains

Limited disclosure at @vivek-p's request...

DDN SFA Default SSH Keys

DDN Default SSH Keys DDN SFA devices have default SSH keys in place Product: DDN SFA storage devices, all versions, all models Severity: High CVE Reference: NO CVE ASSIGNED - MWR ref: MWR-2016-0002 Type: Default Credentials Author: John Fitzpatrick Date: 2016-06-15 Description DDN controllers shi...

HackerOne: Old titles are not hidden in reports with limited disclosure

When a report is made public it shows all activity that took place in that report. This includes showing if the title of the report was changed and what it was changed from. This could cause information to be public that the business may not wish to make public if the person that created the repo...

Uber: Email Enumeration Vulnerability

Hello, I identified from one of your disclosed reports : the report 143291 that you added "security measures to help mitigate email enumeration" . However , I found a way to identify valid emails registered on Uber.com . I used the SIGN UP form to find if an email is valid or not. Proof of concep...

Unrestricted qemu logging

ISSUE DESCRIPTION When the libxl toolstack launches qemu for HVM guests, it pipes the output of stderr to a file in /var/log/xen. This output is not rate-limited in any way. The guest can easily cause qemu to print messages to stderr, causing this file to become arbitrarily large. IMPACT The disk...

File Upload Vulnerability in OA System of Wando Network Technology Co.

Wando Network Technology Limited OA system is a set of office software. A file upload vulnerability exists in the Wando Network Technology Ltd OA system, which can be exploited by attackers to gain control of the website...

[SECURITY] [DLA 465-1] debian-security-support update

Package : debian-security-support Version : 2016.05.09+nmu1deb7u1 It is not feasible to fully support some Debian packages through the releases life cycle. The debian-security-support package provides the check-support-status tool that helps to warn the administrator about installed packages whos...

Exide Industries Limited - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Exide Industries Limited published at the 'play' market has multiple vulnerabilities...

Threat Outbreak Alert RuleID22517: Email Messages Distributing Malicious Software on April 27, 2016

Medium Alert ID: 44866 First Published: 2016 April 27 14:12 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22517 may contain the following files: Name | Si...

Shopify: staff memeber can install apps even if have limitied access

hey ; for example staff member have limit access to orders when this memeber want install app scope readorders ,error message showed : Oauth error invalidrequest: You do not have permission to access the requested scopes bug: ----- staff memeber can install app even if have limit access to scops...

Panda Security URL Filtering < 4.3.1.9 - Privilege Escalation

Exploit for windows platform in category local exploits CVE: CVE-2015-7378 Vendor: Panda Security Reported by: Kyriakos Economou Date of Release: 05/04/2016 Affected Products: Multiple Affected Version: Panda Security URL Filtering v4.3.1.9 Fixed Version: Panda Security URL Filtering v4.3.1.9...

Panda Security URL Filtering 4.3.1.9 - Local Privilege Escalation

Panda Security URL Filtering 4.3.1.9 - Local Privilege Escalation CVE: CVE-2015-7378 Vendor: Panda Security Reported by: Kyriakos Economou Date of Release: 05/04/2016 Affected Products: Multiple Affected Version: Panda Security URL Filtering v4.3.1.9 Fixed Version: Panda Security URL Filtering...