PT-2020-17394

Name of the Vulnerable Software and Affected Versions Daybyday version 2.1.0 Description The issue allows stored XSS via the Name parameter to the New User screen. This can lead to malicious script execution when the stored data is viewed. Recommendations For Daybyday version 2.1.0, avoid using t...

CVE-2020-35707: Improper Neutralization of Input During Web Page Generation

Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen...

Bottelet Daybyday Crm Cross-Site Scripting Vulnerability

Bottelet Daybyday Crm is a builder system for task, time, employee, and vacation management by Bottelet Personal Developers. A cross-site scripting vulnerability exists in Bottelet Daybyday Crm 2.1.0, which allows storing XSS via the company name parameter to a new client screen...

CVE-2020-35706: Improper Neutralization of Input During Web Page Generation

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen...

PT-2020-17395

Name of the Vulnerable Software and Affected Versions Daybyday version 2.1.0 Description The issue allows stored XSS via the Title parameter to the New Project screen. This means an attacker can inject malicious scripts into the title of a project, which can then be executed when other users view...

PT-2020-17396

Name of the Vulnerable Software and Affected Versions Daybyday version 2.1.0 Description The issue allows stored XSS via the Company Name parameter to the New Client screen. This enables potential attackers to inject malicious scripts into the application. Recommendations For Daybyday version...

CVE-2020-35704: Improper Neutralization of Input During Web Page Generation

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen...

CVE-2020-35705: Improper Neutralization of Input During Web Page Generation

Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen...

CVE-2020-35585

In Solstice Pod before 3.3.0 or Open4.3, the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because there are only 1.7 million possibilities...

CVE-2020-35584

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any...

CVE-2020-35585

In Solstice Pod before 3.3.0 or Open4.3, the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because there are only 1.7 million possibilities...

CVE-2020-35584

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any...

PT-2020-17352

Name of the Vulnerable Software and Affected Versions Solstice Pod versions prior to 3.3.0 Solstice Pod version Open4.3 Description The issue allows the screen key to be enumerated using brute-force attacks via the "/lookin/info" Solstice Open Control API endpoint, due to a limited number of...

CVE-2020-35585: Improper Restriction of Excessive Authentication Attempts

In Solstice Pod before 3.3.0 or Open4.3, the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because there are only 1.7 million possibilities...

GNOME Display Manager License Issue Vulnerability

GNOME Display Manager GDM is a display manager. GNOME Display Manager suffers from an authorization issue vulnerability that can be exploited by an attacker to bypass restrictions via GDM's auto-lock screen in order to gain privileges...

Mersive Solstice Pod Security Vulnerability

Mersive Solstice Pod is a software application for conference screen sharing from Mersive USA. A security vulnerability exists in versions prior to Solstice Pod 3.3.0 or Open4.3, which can be exploited to enumerate screen keys using a strong attack via the lookin info winter to the Open Control...

CVE-2020-35555

An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconnection of a call with the cover closed. The LG ID is LVE-SMP-200027 December 2020...

Design/Logic Flaw

An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconnection of a call with the cover closed. The LG ID is LVE-SMP-200027 December 2020...

CVE-2020-35555

An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconnection of a call with the cover closed. The LG ID is LVE-SMP-200027 December 2020...

LG mobile security breach

LG mobile is a mobile device by LG A security vulnerability exists in LG mobile devices with Android OS 10, which stems from the fact that the device does not lock when disconnected from a call with the cover closed when dual screen configuration is supported...