CVE-2021-41139

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time Tracker, it is being passed on via the date parameter in URI. Because of not checking this parameter for sanity in versions prior to 1.19.30.5600, it was possible...

CVE-2021-41139

Anuko Time Tracker (PHP) suffers a reflected XSS in time.php via the date URI parameter, exploitable before patch in 1.19.30.5600. An attacker could persuade a logged-in user to click a crafted link, causing attacker-supplied JavaScript to execute in the user’s browser. Remediated in version 1.19...

CVE-2013-4341

creationtimestamp| type| source ---|---|--- 2021-10-11 22:36:30+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/moodlespellingbinaryrce.rb 2025-02-06 03:13:41+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:09:19+00:00| seen...

webTareas Cross-Site Scripting Vulnerability (CNVD-2021-85276)

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas, which can be exploited by an attacker to store arbitrary web script or HTML by...

Cypress Solutions CTM-200/CTM-ONE Hard-Coded Credentials Remote Root

!/usr/bin/env python3 Cypress Solutions CTM-200/CTM-ONE Hard-coded Credentials Remote Root Telnet/SSH Vendor: Cypress Solutions Inc. Product web page: https://www.cypress.bc.ca Affected version: CTM-ONE 1.3.6-latest CTM-ONE 1.3.1 CTM-ONE 1.1.9 CTM200 2.7.1.5659-latest CTM200 2.0.5.3356-184 Summar...

webTareas Code Issues Vulnerabilities

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas 2.4 and earlier versions that allows an attacker to exploit the platform by...

Smersh - A Pentest Oriented Collaborative Tool Used To Track The Progress Of Your Company'S Missions

Smersh is a pentest oriented collaborative tool used to track the progress of your company's missions and generate rapport. Preview front Angular: Documentation All information is available at the following address: https://docs.smersh.app How to contribute ? Just fork repository then create...

bugs Cross-site scripting vulnerabilities

Bugs is a branch of the open source Tinyissue defect tracking system by Alexandre Plennevaux, a personal developer in Belgium. bugs 1.8 and earlier versions of install/index.php are vulnerable to cross-site scripting, which can be exploited by remote attackers to inject arbitrary Web script or HT...

Military’s RFID Tracking of Guns May Endanger Troops

Reports that the military has started outfitting firearms with RFID tags for tracking have raised security alarms. The concern: What if the enemy uses the tags to track soldiers on the battlefield? The Department of Defense, the Marines and the Navy have already rejected the RFID tagging tech for...

HeapTrack alloc Heap Overflow DoS

The vulnerability of the HeapTrackalloc function implementation kernel/tirtos/packages/ti/sysbios/heaps/HeapTrack.c in the software development kit for microcontroller series CC13XX, CC26XX, CC32XX, and MSP432E4 arises due to a numerical overflow condition. Exploiting this vulnerability can allow...

SUSE-SU-2021:3251-1 Security update for python-urllib3

This update for python-urllib3 fixes the following security issue: - CVE-2020-26137: A CRLF injection via HTTP request method was fixed bsc1177120 Note that this was fixed in a previous version update to 1.25.9, this update just complements the tracking...

Tracking Stolen Cryptocurrencies

Good article about the current state of cryptocurrency forensics...

Google, geofence warrants, and you

Another day, another example of how the data sharing choices we make can come back to haunt us. The Guardian reports a Florida resident finding his bike ride data requested by law enforcement. This is due to his route taking him close to the scene of a burglary a year earlier. According to the...

CVE-2021-22005

creationtimestamp| type| source ---|---|--- 2021-09-22 05:17:02+00:00| seen| https://t.me/thehackernews/1528 2021-09-22 14:26:45+00:00| exploited| https://t.me/ctinow/40137 2021-09-22 22:32:08+00:00| exploited| https://t.me/BleepingComputer/10542 2021-09-22 23:56:16+00:00| seen|...

What are computer cookies?

We all know cookies as tasty baked treats that we love to eat, but computer cookies are quite different. Although they’re most popularly known as just "cookies", they may be referred to as browser cookies, Internet cookies, HTTP cookies, web cookies, computer cookies, or digital cookies. What are...

Operation Layover: How we tracked an attack on the aviation industry to five years of compromise

By Tiago Pereira and Vitor Ventura. Cisco Talos linked the recent aviation targeting campaigns to an actor who has been targeting the aviation industry for two years.The same actor has been running successful malware campaigns for more than five years.Although always using commodity malware, the...

Controller.inCaseStrategyGetStuck does not update balance

Handle cmichel Vulnerability details The Controller.inCaseStrategyGetStuck withdraws from a strategy but does not call updateBalancevault, strategy afterwards. Impact The vaultDetailsvault.balancesstrategy variable does not correctly track the actual strategy balance anymore. I'm not sure what...

CVE-2021-3709

Function checkattachmentforerrors in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to...

Deposits into vaults are not tracked at a token level

Handle itsmeSTYJ Vulnerability details Impact If the strategy used accepts multiple tokens, a user can deposit in a cheaper token and withdraw in a more expensive token because the vault only tracks ownership based on how many shares they own. Proof of Concept 1. An approved strategist adds 2...

CVE-2021-1861

An issue existed in determining cache occupancy. The issue was addressed through improved logic. This issue is fixed in macOS Big Sur 11.3. A malicious website may be able to track users by setting state in a cache...