For 2nd Time in 3 Years, Mobile Spyware Maker mSpy Leaks Millions of Sensitive Records

mSpy, the makers of a software-as-a-service product that claims to help more than a million paying customers spy on the mobile devices of their kids and partners, has leaked millions of sensitive records online, including passwords, call logs, text messages, contacts, notes and location data...

FsPro Labs Event Log Explorer 4.6.1.2115 XML Injection

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FSPRO-LABS-EVENT-LOG-EXPLORER-XML-INJECTION-INFO-DISCLOSURE.txt + ISR: ApparitionSec Greetz: Greetz: indoushka | Eduardo Vendor www.eventlogxp.com Product Event Log Explorer v4.6.1.2115...

CVE-2018-16236

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...

Cross site scripting

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...

CVE-2018-16236

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...

CVE-2018-16236

cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during frontend/THEME/raw/index.html rendering...

CVE-2018-16236

CVE-2018-16236 affects cPanel through version 74, allowing XSS via a crafted filename in the logs subdirectory of a user account. The root cause is that the filename is mishandled during rendering of frontend/THEME/raw/index.html, enabling script injection. Exploit details (in-the-wild, vectors) ...

Orbic Wonder Information Disclosure Vulnerability

Orbic Wonder is a smartphone product from Orbic USA. An information disclosure vulnerability exists in Orbic Wonder's Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys. An attacker can exploit the vulnerability to read a copy of the Android logs on an SD card to obtain sensitive...

MyBB Moderator Log Notes Plugin Cross-Site Request Forgery Vulnerability

MyBB aka MyBulletinBoard is a free and Web-based forum software developed by the MyBB team using PHP and MySQL.Moderator Log Notes plugin is used in one of the plug-ins used to manage log records. A cross-site request forgery vulnerability exists in version 1.1 of the MyBB Moderator Log Notes...

Jenkins Sensitive Information Disclosure Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...

Design/Logic Flaw

A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent...

Countly Cross Site Scripting

Exploit Title: Countly-server StoredPersistent XSS Vulnerability Date: Monday - 2018 13 August Author: 10:10AM Team Discovered By: Sleepy Software Link: https://github.com/Countly/countly-server Version: All Version Category: Web-apps Security Risk: Critical Tested on: GNU/Linux Ubuntu 16.04 - wi...

CVE-2018-1000633

The Open Microscopy Environment OMERO.web version prior to 5.4.7 contains an Information Exposure Through Log Files vulnerability in the login form and change password form that can result in User's password being revealed. Attacker can log in as that user. This attack appear to be exploitable vi...

Countly - Cross-Site Scripting

Countly - Cross-Site Scripting Exploit Title: Countly-server StoredPersistent XSS Vulnerability Date: Monday - 2018 13 August Author: 10:10AM Team Discovered By: Sleepy Software Link: https://github.com/Countly/countly-server Version: All Version Category: Web-apps Security Risk: Critical Tested...

Countly - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Countly-server StoredPersistent XSS Vulnerability Discovered By: Sleepy Software Link: https://github.com/Countly/countly-server Version: All Version Category: Web-apps Security Risk: Critical Tested on: GNU/Linux Ubuntu 16.04 -...

Countly - Cross-Site Scripting

Exploit Title: Countly-server StoredPersistent XSS Vulnerability Date: Monday - 2018 13 August Author: 10:10AM Team Discovered By: Sleepy Software Link: https://github.com/Countly/countly-server Version: All Version Category: Web-apps Security Risk: Critical Tested on: GNU/Linux Ubuntu 16.04 - wi...

FreeBSD : jenkins -- multiple vulnerabilities (6905f05f-a0c9-11e8-8335-8c164535ad80)

Jenkins Security Advisory : DescriptionLow SECURITY-637 Jenkins allowed deserialization of URL objects with host components Medium SECURITY-672 Ephemeral user record was created on some invalid authentication attempts Medium SECURITY-790 Cron expression form validation could enter infinite loop,...

CVE-2018-8373

creationtimestamp| type| source ---|---|--- 2018-08-15 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=316 2018-08-16 05:48:34+00:00| seen| MISP/5b75100d-54dc-420e-8c2f-5667ac100a5a 2018-08-20 19:07:25+00:00| seen| MISP/5b7b1061-8fd4-417a-84d7-23d2ac12042b 2018-09-26...

Nextcloud Server Improper Input Validation Vulnerability

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany.Nextcloud Server is one of the server version. An input validation vulnerability exists in Nextcloud Server versions prior to 12.0.3 and 11.0.5, which can be exploite...

Valve: Getting all the CD keys of any game

Using the /partnercdkeys/assignkeys/ endpoint on partner.steamgames.com with specific parameters, an authenticated user could download previously-generated CD keys for a game which they would not normally have access. Audit logs were not bypassed using this method, and an investigation of those...