AliCloud Storage Application Override Access and File Upload Vulnerability

Cloud storage is a new concept developed on the basis of the extension and derivation of cloud computing, the integrated use of distributed processing, parallel processing and grid computing and other means, the network of different types of storage devices through the application software...

TypeStack class-validator SQL Injection Vulnerability

TypeStack class-validator is a class validator. A SQL injection vulnerability exists in TypeStack class-validator version 0.10.2, which can be exploited to bypass security checks by injecting attribute entries into user input to override internal attribute entries with the same name...

LJCMS has an override access vulnerability

LJCMS is a free and open source content management system. LJCMS suffers from an override access vulnerability that can be exploited by attackers to obtain sensitive information...

Microsoft Edge and Internet Explorer Spoofing Vulnerability

Microsoft Edge and Microsoft Internet Explorer IE are both products of Microsoft Corporation.Microsoft Edge is a web browser that comes with Windows 10 and later.Microsoft Internet Explorer is a web browser that comes with Windows operating systems. Microsoft Edge is a web browser that comes with...

PRODSECBUG-2425: Cross-Site Scripting via Signifyd Guarantee Option Translation Override

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

Qualys Cloud Platform 2.41 New Features

This release of the Qualys Cloud Platform version 2.41 includes updates and new features for new Gov clouds in AssetView / CloudView and Web Application Scanning, highlights as follows. AssetView Microsoft Azure Gov Cloud Connector – Added connector support for Microsoft Azure Gov Clouds, includi...

Configuration Override

Overview Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy CSP. The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an...

Circumvents open_basedir INI directive

ADVISORY: This release circumvents openbasedir in the requestinithook. If you rely on the openbasedir INI directive, we highly recommended you upgrade to 0.30.2. Fixed - Shutdown span flushing blocking the process when forked 493 - Memory access errors in cases when PHP code was run after extensi...

DRUPAL-CONTRIB-2019-066

This module enables you to have a separate permission only for creating users. The module doesn't respect Drupal's setting for "Who can register accounts?" when set to "Visitors, but administrator approval is required". When this option is chosen, the module overrides the setting, and makes it...

XpShop Mall System Vulnerability in Shenzhen Xinpu Software Development Co.

Shenzhen Xinpu Software Development Co., Ltd. is an e-commerce system development as the core of the station-building company. Shenzhen Xinpu Software Development Co., Ltd XpShop mall system has an override access vulnerability, which can be exploited by attackers to obtain sensitive information...

CVE-2019-5681

NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the custom NVIDIA API used in the mount system service where user data could be overridden, which may lead to code execution, denial of service, or information disclosure...

FreeBSD : Gitlab -- Multiple Vulnerabilities (1cd89254-b2db-11e9-8001-001b217b3468)

Gitlab reports : GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

B2B2C Multi-User Mall System Existing Vulnerabilities in B2B2C Multi-User Mall System

Business Amoy software B2B2C multi-user mall system is a comprehensive mall platform to support multi-store stationed. Business Amoy software B2B2C multi-user mall system there is an override access vulnerability, the vulnerability stems from the failure to set the rights of strict authentication...

CVE-2019-10189

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment...

Design/Logic Flaw

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz...

CVE-2019-10188

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz...

CVE-2019-10189

CVE-2019-10189 affects Moodle prior to 3.7.1, 3.6.5, and 3.5.7. The vulnerability is an improper access control vulnerability where teachers in an assignment group can modify group overrides for other groups within the same assignment. The description only states the existence and affected versio...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...

Override Access Vulnerability in Niushop Mall System

Shanxi NiuKu Information Technology Co., Ltd. is a technical enterprise engaged in the development of mobile Internet-oriented. Niushop mall system has an override access vulnerability, which can be exploited by attackers to modify other users' information...

CloudBees Jenkins Unauthorized Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Dependency Graph Viewer Plugin is used in...