5334 matches found
Simple E-Learning System SQL Injection Vulnerability
Simple E-Learning System is a simple e-learning system from Carlo Montero's personal developer. simple E-Learning System is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in the parameter phoneNumber of the file /claireblake. statements. An...
How to Use Lockdown Mode in iOS 16 to Make Your Phone More Secure
Whether you want to turn off link previews or block unwanted FaceTime calls, here's what you need to know...
How to protect yourself and your kids against device theft
In no time at all, kids will be going back to school or starting college. And while gearing up for this, it’s very important to be aware of the threat from device loss in the school environment. Maybe you are away at university for the first time and have a new place to live, or maybe your kids...
How to protect yourself and your kids against device theft
In no time at all, kids will be going back to school or starting college. And while gearing up for this, its very important to be aware of the threat from device loss in the school environment. Maybe you are away at university for the first time and have a new place to live, or maybe your kids ha...
Vulnerability Spotlight: How misusing properly serialized data opened TCL LinkHub Mesh Wi-Fi system to 17 vulnerabilities
By Carl Hurd. The TCL LinkHub Mesh Wi-Fi system is a multi-device Wi-Fi system that allows users to expand access to their network over a large physical area. What makes the LInkHub system unique is the lack of a network interface to manage the devices individually or in the mesh. Instead, a phon...
CVE-2022-0598
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-0598
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2022-0598 Login with phone number < 1.3.8 - Multiple Admin+ Stored XSS
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
WordPress plugin for login using phone number – cross-site scripting vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
TCL LinkHub Mesh Wifi confctl_get_guest_wlan information disclosure vulnerability
Talos Vulnerability Report TALOS-2022-1503 TCL LinkHub Mesh Wifi confctlgetguestwlan information disclosure vulnerability August 1, 2022 CVE Number CVE-2022-27633 SUMMARY An information disclosure vulnerability exists in the confctlgetguestwlan functionality of TCL LinkHub Mesh Wifi MS1G0001.0014...
CVE-2022-0598: Improper Neutralization of Input During Web Page Generation
The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
PT-2022-13293 · WordPress · Login With Phone Number
Name of the Vulnerable Software and Affected Versions: Login with phone number WordPress plugin versions prior to 1.3.8 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape its settings, even when the...
How to Safely Lend Someone Else Your Phone
The next time someone wants to borrow your device to make a call or take a picture, take these steps to protect your privacy...
The DHS Bought a ‘Shocking Amount’ of Phone-Tracking Data
The ACLU released a trove of documents showing how Homeland Security contracted with surveillance companies to scour location information...
Malicious code in redox-phone-support (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9de8068327d3a4c7a9da434d81a434af1140129169e3f56565d519fdf4ed080a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5723 Malicious code in redox-phone-support (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9de8068327d3a4c7a9da434d81a434af1140129169e3f56565d519fdf4ed080a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Rest Phone Apps web interface Code Execution
The vulnerability of the Rest Phone Apps web interface for controlling IP telephony systems like FreePBX lies in the ability to inject code into the URL addresses. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Hackers Targeting VoIP Servers By Exploiting Digium Phone Software
VoIP phones using Digium's software have been targeted to drop a web shell on their servers as part of an attack campaign designed to exfiltrate data by downloading and executing additional payloads. "The malware installs multilayer obfuscated PHP backdoors to the web server's file system,...
CVE-2022-20223
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...
Privilege escalation
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible way to start a phone call without permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...