Customer Relationship Management System (CRM) 1.0 - Remote Code Execution Exploit

Exploit Title: Customer Relationship Management System CRM 1.0 - Remote Code Execution Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html Software Link:...

Customer Relationship Management System (CRM) 1.0 - Remote Code Execution

Exploit Title: Customer Relationship Management System CRM 1.0 - Remote Code Execution Date: 21.06.2021 Exploit Author: Ishan Saha Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html Software Link:...

Unikrn: Open URL Redirection

Open URL Redirect Steps To Reproduce: 1 Go to the following link & Register for new account https://unikrn.com/██████ 2 After registering It will redirect to example.com Reference: https://www.owasp.org/index.php/UnvalidatedRedirectsandForwardsCheatSheet Impact The attacker can force the user to...

Information Disclosure

@apollosproject/data-connector-rock is vulnerable to information disclosure. Registration of a new user allows a user who knows basic profile information name, birthday, gender, etc of anyone to access anyone's account using all app functionality within the app...

Apollos Apps licensing issue vulnerability

Apollos Apps is an open source platform for distributing church-related applications. Apollos Apps suffers from an authorization issue vulnerability that stems from the fact that new user registrations only need to know basic personal information about anyone name, birthday, gender, etc. in order...

The vulnerability of the Cisco Jabber software platform, related to insufficient protection of registration data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Cisco Jabber software platform is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially crafted XMPP message...

The vulnerability of the McAfee True Key Windows Client password storage tool allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the McAfee True Key Windows Client password storage tool relates to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

OpenEMR 5.0.1.3 Authentication Bypass

Exploit Title: OpenEMR 5.0.1.3 - '/portal/account/register.php' Authentication Bypass Date 15.06.2021 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.open-emr.org/ Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5013.zip Version: All versions prior to 5.0.1...

CVE-2021-32612

The VeryFitPro com.veryfit2hr.second application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, registrations, and password change requests. This allows information theft and account takeover via network sniffing...

The vulnerability of Belden Hirschmann HiOS and HiSecOS operating systems lies in the insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Belden Hirschmann HiOS and HiSecOS lies in the insufficient protection of registration data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Vulnerability of healthcare registration and authentication systems: VerityStream MSOW Solutions, due to inadequate protection of operational data, allows unauthorized access by attackers to protected information.

The vulnerability of the registration and authentication systems in the healthcare sector, addressed by VerityStream MSOW Solutions, is related to deficiencies in protecting operational data. Exploiting this vulnerability could allow unauthorized actors to gain unauthorized access to protected...

JVN#79254445: Multiple ETUNA EC-CUBE plugins vulnerable to cross-site scripting

Multiple EC-CUBE plugins provided by ETUNA contain a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE. As of 2021 June 15, an attack exploting this vulnerability has been observed in the wild. Impact...

The vulnerability of the client’s execution file airhost.exe allows unauthorized access to protected information when conducting real-time audio and video conferences using Zoom Client for Meetings.

The vulnerability of the airhost.exe executable file used by clients for real-time audio and video conferencing with Zoom Client for Meetings is related to the rigid encoding of registration data when using the SHA-256 hashing algorithm. Exploiting this vulnerability can allow a malicious...

COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)

Exploit Title: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting XSS Date: 11/06/2021 Exploit Author: BHAVESH KAUL Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on:...

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...

CVE-2021-22175

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...

Server side request forgery (ssrf)

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled...

CVE-2021-22175

Removed by vendor...

QIWI: Account Takeover through registration to the same email address

На ресурсе shop.tochka.com была обнаружена уязвимость, приводящая к перехвату аккаунта с помощью регистрации нескольких аккаунтов на один почтовый ящик...

GitLab 代码问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. GitLab A cross-site request forgery vulnerability exists ...