IBM Cognos Analytics Cross-Site Scripting Vulnerability (CNVD-2021-95141)

IBM Cognos Analytics is a suite of business intelligence software from IBM Corporation. A cross-site scripting vulnerability exists in IBM Cognos Analytics, which stems from a failure to validate user data data in the product's web ui. An attacker could cause credentials in a trusted session to b...

CVE-2021-24915

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

Italy's Antitrust Regulator Fines Google and Apple for "Aggressive" Data Practices

Italy's antitrust regulator has fined both Apple and Google €10 million each for what it calls are "aggressive" data practices and for not providing consumers with clear information on commercial uses of their personal data during the account creation phase. The Autorità Garante della Concorrenza...

9.3M+ Androids Running ‘Malicious’ Games from Huawei AppGallery

Why would a game about a cat’s “cute diary” need permission to make phone calls or suss out your location? It doesn’t: “Cat cute diary” is one of 190 trojanized games that Doctor Web malware analysts have found on AppGallery, the official app store for Huawei Android. They’re littering the Androi...

Rapid7 Nexpose 信息泄露漏洞

Rapid7 Nexpose is a set of vulnerability management software from Rapid7, Inc. that can use scan results to deeply probe a network. The software supports scanning configuration environments for errors, vulnerabilities, malware, etc. Rapid7 Nexpose has an information disclosure vulnerability that...

Apache ShardingSphere 代码问题漏洞

Apache ShardingSphere, an open source distributed database middleware solution from the Apache Foundation, has a security vulnerability in the Apache ShardingSphere UI that stems from insecure deserialization of serialized data received by the application from users, which could be exploited by a...

SUSE-SU-2021:3651-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: MozillaFirefox was updated to Extended Support Release 91.3.0 ESR Fixed: Various stability, functionality, and security fixes MFSA 2021-49 bsc1192250 CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets CVE-2021-38504:...

Fortinet FortiManager Information Disclosure Vulnerability (CNVD-2022-58481)

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and...

GitLab EE Cross-Site Scripting Vulnerability (CNVD-2021-87036)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab EE...

Opencart 3 Extension TMD Vendor System SQL Injection

Exploit Title: Opencart 3 Extension TMD Vendor System - Blind SQL Injection Author: Muhammad Zaki Sulistya [email protected] Date: 03-11-2021 Product: TMD Vendor System Vendor Homepage: https://www.opencartextensions.in/ Software Link:...

Opencart 3 Extension TMD Vendor System - Blind SQL Injection Exploit

Exploit Title: Opencart 3 Extension TMD Vendor System - Blind SQL Injection Author: Muhammad Zaki Sulistya email protected Product: TMD Vendor System Vendor Homepage: https://www.opencartextensions.in/ Software Link: https://www.opencartextensions.in/opencart-multi-vendor-multi-seller-marketplace...

Fortinet FortiWLC SQL注入漏洞

Fortinet FortiWLC is a wireless LAN controller from Fortinet. A security vulnerability in Fortinet FortiWLC version 8.6.1 and below can be exploited by an attacker to disclose device, user, and database information via a crafted HTTP request...

Huawei Emui and Magic UI Input Validation Vulnerability

Huawei Emui is a mobile operating system developed based on Android.Magic Ui is a mobile operating system developed based on Android. An input validation vulnerability exists in Huawei Emui and Magic UI. The vulnerability stems from the product not validating user input data. An attacker could...

CVE-2021-38426

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code...

Default credentials

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code...

Stack overflow

FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-based buffer overflow condition and allow an attacker to remotely execute code...

Foxit PDF Reader 缓冲区错误漏洞

Foxit PDF Reader is a PDF reader from Foxit China.A security vulnerability exists in Foxit PDF Reader caused by a lack of proper validation of user-supplied data, which could result in reading beyond the end of the assigned object. An attacker could exploit this vulnerability to execute arbitrary...

Apache Superset up和Apache Superset 跨站脚本漏洞

A cross-site scripting vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, U.S. The vulnerability stems from insufficient cleanup of user-supplied data on browser pages. An attacker could exploit the vulnerability to trick victim...

Easytest 安全漏洞

Easytest is an online learning quiz platform of China's Huaju Digital Technology, Inc. Easytest is vulnerable to authorization issues, which can be exploited by remote attackers to access user and administrator account information other than passwords by constructing URL parameters after gaining...

Flickr: critical server misconfiguration lead to access to any user sensitive data which include user email and password

Hi flickr team, I found a critical issue lead to access to any user sensitive data which include user hashed password and possibly can lead to takeover any user account on flickr's main site, literally i can get all user information from database with no restrictions , Let me explain how this...