2199 matches found
Mail.ru: [my.games, lootdog.io] XSS via MCS Bucket
Proxy pass for the path in my.games and lootdog.io domains was misconfigured to point to the root of public S3 storage, allowing to place static content in the domain path leading to XSS possibility...
CVE-2020-12621
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
CVE-2020-12621
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
Design/Logic Flaw
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
CVE-2020-12621
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
CVE-2020-12621
CNVD-2021-30165 indicates an encryption issue in Android Teamwire 5.3.0, where the encryption implementation does not properly use cryptographic algorithms, causing content to be not properly encrypted or stored in plaintext. A remote attacker could exploit this via cryptographically related comp...
CVE-2020-12621: Missing Authentication for Critical Function
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
Curfew e-Pass Management System 1.0 SQL Injection
Exploit Title: Curfew e-Pass Management System 1.0 Multiple SQL Injection Vulnerabilities Google Dork: N/A Date: 04.08.2020 Exploit Author: Mucahit Karadag Vendor Homepage: https://products.phpgurukul.com/product/curfew-e-pass-management-system-project-report/ Software Link:...
Curfew e-Pass Management System 1.0 SQL Injection Vulnerability
Curfew e-Pass Management System version 1.0 suffers from multiple remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to gh1mau. Exploit Title: Curfew e-Pass Management System 1.0 Multiple SQL Injection Vulnerabilities Exploit Author: Mucahit...
Citrix Single Sign-On (SSONSVR.exe) Fails to Start on Computers using Intel Credentials Manager
Pass through authentication is not working and SSONSVR.exe does not appear in Task Manager...
business.grantspasschamber.org Cross Site Scripting vulnerability OBB-1231548
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Curfew e-Pass Management System 1.0 SQL Injection
Exploit Title: Curfew e-Pass Management System - 'searchdata' SQL Injection Date: 2020-07-07 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/curfew-e-pass-management-system-using-php-and-mysql/ Software...
Curfew e-Pass Management System 1.0 SQL Injection Exploit
Exploit for php platform in category web applications Exploit Title: Curfew e-Pass Management System - 'searchdata' SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...
Cross site request forgery (csrf)
An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wpoptions table, such as the login and pass...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for WebSphere MQ Internet Pass-Thru - April 2020 - Includes Oracle April 2020 CPU (CVE-2020-2781)
Summary WebSphere MQ Internet Pass-Thru has addressed the following vulnerability in IBM® Runtime Environment Java™ Version 7.0.10.50 and earlier. This issue was disclosed as part of the IBM Java SDK updates in April 2020. Vulnerability Details CVEID: CVE-2020-2781 DESCRIPTION: An unspecified...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for WebSphere MQ Internet Pass-Thru - Jan 2020 - Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590
Summary WebSphere MQ Internet Pass-Thru has addressed the following vulnerability in IBM® Runtime Environment Java™ Version 7.0.10.50 and earlier. This issue was disclosed as part of the IBM Java SDK updates in January 2020. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java...
CVE-2020-14156: Incorrect Default Permissions
userchannel/passwdmgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions...
Cross-site Request Forgery (CSRF)
intelliants/subrion is vulnerable to cross-site request forgery CSRF. The vulnerability exists as it improperly invalidates the CSRF token for the panel/uploads/read.json GET request, potentially causing deletion of a file pass when the cmd=rm parameter value is set...
HiveJack - This Tool Can Be Used During Internal Penetration Testing To Dump Windows Credentials From An Already-Compromised Host
This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Often, this i...
CVE-2020-7988: Cross-Site Request Forgery (CSRF)
An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lac...