Design/Logic Flaw

In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves...

Rittal Chiller SK 3232-Series Improper Access Control Vulnerability

The Rittal Chiller SK 3232-Series is a liquid cooling device from Rittal, Germany. An improper access control vulnerability in the web interface in the Rittal Chiller SK 3232-Series, which arises from an authentication mechanism that is not sufficiently protected to prevent unauthorized...

YjV2XfO8XULm45N

A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...

CVE-2019-13953

CVE-2019-13953 affects the BLE authentication module in the YI M1 Mirrorless Camera V3.2-cn. The vulnerability allows an attacker to bypass authentication by sending a sequence of BLE commands, enabling sensitive data leakage (e.g., personal photos) and the ability to control the camera to record...

CVE-2019-11061

A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://target/smarthome/devicecontrol without any authentication. CVSS 3.0 base score 10 Confidentiality, Integrity...

Prima Systems FlexAir

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Prima Systems Equipment: FlexAir Vulnerabilities : OS Command Injection, Unrestricted Upload of File with Dangerous Type, Cross-site Request Forgery, Small Space of Random Values, Cross-site...

Directory traversal

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existi...

CVE-2019-3935

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to conference.cgi. A remote, unauthenticated attacker can use this vulnerability to start, stop, and disconnect active slideshows...

Design/Logic Flaw

Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUBE50015, an attacker is able to predict valid future rolling codes, and can thus remotely control the alarm system in an unauthorized way...

Joomla Akeeba Backup 6.3.3 Database Disclosure

Exploit Title : Joomla Akeeba Backup Components 6.3.3 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 19/01/2019 Vendor Homepage : akeebabackup.com Software Information Link : extensions.joomla.org/extension/akeeba-backup/ Software Download...

Joomla ZHYandexMap 8.0.0.2 Database Disclosure

Exploit Title : Joomla ZHYandexMap Components 8.0.0.2 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/01/2019 Vendor Homepage : joomla.org Software Information Link : extensions.joomla.org/extension/zh-yandexmap/ Software Download Link :...

WordPress Disqus Comment System 2.87 Database Disclosure

Exploit Title : WordPress Disqus Comment System Plugins 2.87 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : disqus.com wordpress.org/plugins/disqus-comment-system/ Software Download Link :...

WordPress Custom-Blocks SypexGeo 1.0 Database Disclosure

Exploit Title : WordPress Custom-Blocks SypexGeo Plugins 1.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 08/12/2018 Vendor Homepage : wordpress.org Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version...

Design/Logic Flaw

An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP Server Controller HUB Node products which are controlled by HUB. The prerequisite is that the attacker is on the same network as the target HUB, and can use I...

WordPress Caldera Forms 1.7.4 Database Disclosure

Exploit Title : WordPress Caldera Forms Plugins 1.7.4 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : wordpress.org/plugins/caldera-forms/ calderaforms.com/updates/caldera-forms-1-7-4/ Software Download Link ...

WordPress Search-Engine 0.5.9 Database Disclosure

Exploit Title : WordPress Search-Engine Plugins 0.5.9 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : wordpress.org/plugins/search-engine/ Software Download Link :...

WordPress Orbis 1.3.3 Database Disclosure

Exploit Title : WordPress Orbis Plugins 1.3.3 Pronamic Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : pronamic.eu wordpress.org/plugins/orbis/ Software Download Link :...

WordPress newwpml 3.0 Database Disclosure

Exploit Title : WordPress newwpml Plugins 3.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 06/12/2018 Vendor Homepage : wordpress.org Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version Information :...

WordPress TemplateOne 1.0 Database Disclosure

Exploit Title : WordPress TemplateOne Themes 1.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/12/2018 Vendor Homepage : wordpress.org dubicars.com Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Versio...

WordPress jomiz-plugins-accounting 1.0 Database Disclosure

Exploit Title : WordPress jomiz-plugins-accounting Plugins 1.0 Database Backup Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/12/2018 Vendor Homepage : wordpress.org Tested On : Windows and Linux Software Download Link : N/A Category : WebApps Explo...