CVE-2023-37513 HCL Traveler To Do is vulnerable to revealing sensitive information via the task switcher

When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information...

HCL Technologies Traveler To Do Security Vulnerability

HCL Technologies Traveler is a software from HCL Technologies, USA. It is used to provide automatic, bi-directional, wireless synchronization between HCL Domino servers and wireless handheld devices. A security vulnerability exists in HCL Technologies Traveler To Do, which originates from the...

mschaef toto 跨站脚本漏洞

toto is a to-do list manager by Mike Schaeffer Personal Developer. A security vulnerability exists in mschaef toto version 1.4.20 and earlier versions. An attacker can exploit this vulnerability to perform cross-site scripting attacks...

Grafiki - Threat Hunting Tool About Sysmon And Graphs

Grafiki is a Django project about Sysmon and graphs, for the time being. In my opinion EventViewer, Elastic and even Kibana, are not graphic enough. The current threats are complicated and if attackers think in graphs, defenders also must do it. This is a proof of concept, the code was not debugg...

ADReaper - A Fast Enumeration Tool For Windows Active Directory Pentesting Written In Go

ADReaper is a tool written in Golang which enumerate a Active Directory environment with LDAP queries within few seconds. Installation You can download precompiled executable binaries for Windows/Linux from latest releases Install from source To build from source, clone the repo and build it with...

Cross-site Scripting (XSS) - Stored in leantime/leantime

Description I found Stored XSS in the title of the content. Proof of Concept Step 1.First of all, build the environment with Docker and create an administrator user. 2.Next, create a new "To -DO" from "Project Dashboard" in the left menu. / 3.Next, create an account for the role of "Team Member"...

Jsleak - A Go Code To Detect Leaks In JS Files Via Regex Patterns

jsleak is a tool to identify sensitive data in JS files through regex patterns. Although it's built for this, you can use it to identify anything as long as you have a regex pattern for it. How to install Directly: your package manager install pkg-config libpcre++-dev go get...

CVE-2020-26412

Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2...

Design/Logic Flaw

Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2...

CVE-2020-26412

CVE-2020-26412 affects GitLab Enterprise Edition (EE) versions 13.2 up to, but not including, 13.6.2, where removed group members could use To-Do to retrieve updated information on confidential epics. The root cause is an information-disclosure path via To-Do access by deleted-group members. The ...

CVE-2020-26412

Removed by vendor...

PT-2020-16418 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.2 through 13.6.1 Description: The issue allows removed group members to access updated information on confidential epics using the To-Do functionality. Recommendations: For GitLab EE versions 13.2 through 13.6.1, update ...

GitLab EE 信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab ...

CVE-2020-26507

A CSV Injection also known as Formula Injection vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into th...

CVE-2020-26507

A CSV Injection also known as Formula Injection vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into th...

Shellerator - Simple CLI Tool For The Generation Of Bind And Reverse Shells In Multiple Languages

Shellerator is a simple command-line tool aimed to help pentesters quickly generate one-liner reverse/bind shells in multiple languages Bash, Powershell, Java, Python.... This project is inspired by Print-My-Shell. I just rewrote it and added some options and glitter to it. The lists ofreverse an...

Mordor - Re-play Adversarial Techniques

The Mordor project provides pre-recorded security events generated by simulated adversarial techniques in the form of JavaScript Object Notation JSON files for easy consumption. The pre-recorded data is categorized by platforms, adversary groups, tactics and techniques defined by the Mitre ATT&CK...

FTPBruter - A FTP Server Brute Forcing Tool

Brute forcing tool for FTP server. FTPBruter can work in any OS if they have and support Python 3. Feature Brute force a FTP server with a username or a list of usernames That's all. Install and Run on Linux You have to install Python 3 first: Install Python 3 on Arch Linux and its distros: sudo...

Description of the security update for Outlook 2013: June 13, 2017

Description of the security update for Outlook 2013: June 13, 2017 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...

Any.do: To-Do List, Task List - Dangerous filesystem permissions, Exported ContentProvider, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Any.do: To-Do List, Task List published at the 'play' market has multiple vulnerabilities...