CVE-2022-38472

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird 102.2,...

Multiple Blind SQL Injection Vulnerabilities in Reports

Description SQL injection typically allows an attacker to extract the entire database from the vulnerable website, including user information, encrypted passwords, and business data. This can subsequently lead to mass compromise of user accounts, data being encrypted and held to ransom, or stolen...

PT-2022-28016 · Passhunt · Passhunt

Name of the Vulnerable Software and Affected Versions: Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 Description: The issue allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges via a code execution backdoor in the request...

PT-2022-28015 · Vmware · Vsphere

Name of the Vulnerable Software and Affected Versions: vSphere selfuse version 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 Description: The issue allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges via a code execution backdoor in the reque...

Python3-RESTfulAPI 安全漏洞

Python3-RESTfulAPI is Python3 development and deployment of RESTful API project. Python3-RESTfulAPI commit number: d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 suffers from a security vulnerability that stems from it allowing an Attackers to access sensiti...

Measuring User Experience with Real User Data

Use data from real users to improve the user experience UX of your site or app, and draw on real behavior and outcomes for effective UX decision-making...

CVE-2022-41272

An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search UDS of SAP NetWeaver Process Integration PI - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized...

Open redirect

An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search UDS of SAP NetWeaver Process Integration PI - version 7.50 and make use of an open naming and directory API to access services which can be used to perform unauthorized...

PT-2022-25781 · Sap · Sap Netweaver Process Integration

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Process Integration PI version 7.50 Description: An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search UDS and make use of an open naming and directory API t...

Online Retailer Giant Exposed User Data and Over 1B Records

By Deeba Ahmed The exposed server, which belonged to the global online retailer VEVOR, was exposed twice between April and July 2022. This is a post from HackRead.com Read the original post: Online Retailer Giant Exposed User Data and Over 1B Records...

Main phishing and scamming trends and techniques

There are two main types of online fraud aimed at stealing user data and money: phishing and scams. Phishers primarily seek to extract confidential information from victims, such as credentials or bank card details, while scammers deploy social engineering to persuade targets to transfer money on...

Querybook 跨站脚本漏洞

Querybook is an open source big data query UI for Pinterest. Querybook suffers from a cross-site scripting vulnerability that stems from not escaping fields in user-supplied data. An attacker exploits this vulnerability to execute a cross-site scripting exploit...

PT-2022-25644 · WordPress · 2Kb Amazon Affiliates Store Plugin

Name of the Vulnerable Software and Affected Versions: 2kb Amazon Affiliates Store plugin versions =2.1.5 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially stealing user data or taking...

Hackers Sign Android Malware Apps with Compromised Platform Certificates

Platform certificates used by Android smartphone vendors like Samsung, LG, and MediaTek have been found to be abused to sign malicious apps. The findings were first discovered and reported by Google reverse engineer Łukasz Siewierski on Thursday. "A platform certificate is the application signing...

Sirius XM Software Vulnerability

This is new: Newly revealed research shows that a number of major car brands, including Honda, Nissan, Infiniti, and Acura, were affected by a previously undisclosed security bug that would have allowed a savvy hacker to hijack vehicles and steal user data. According to researchers, the bug was i...

Open Redirect

Opencast is vulnerable to open redirect. The vulnerability exists due to improper sanitization of user-supplied data which allows an attacker to redirect the user to an arbitrary website...

uatech Badaso Remote Command Execution Vulnerability

Badaso is an open source Laravel Vue headless CMS. A remote command execution vulnerability exists in uatech Badaso version 2.6.3, which stems from a failure to properly validate user uploaded data and can be exploited by an unauthenticated, remote attacker to remotely execute arbitrary code on t...

PT-2022-16527 · Unknown · Ourphoto App

Name of the Vulnerable Software and Affected Versions: Ourphoto App version 1.4.1 Description: The issue affects the /device/ end-points, where the user id and device id values suffer from insecure direct object reference vulnerabilities. An attacker can enumerate other end-users' user id and...

CVE-2022-38813

PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete the users, add and manage Blood Group, and Submit Report...

Record Management System Access Control Error Vulnerability

Teachers Record Management System is an open source Teachers Record Management System. Record Management System v1.0 suffers from an Access Control Error vulnerability that originates from improper access control in /Admin/dashboard.php. An attacker can exploit this vulnerability to access and...