Bastard App Has Logic Flaw Vulnerability

Bastard App is an entertainment and creative community. There is a logic flaw vulnerability in Bastard APP. Attackers can use proxy tools to tamper with packets to obtain sensitive user information...

Possible Strong Parameters Bypass in ActionPack

There is a strong parameters bypass vector in ActionPack. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the...

Logic flaw vulnerability in Extreme CMS (CNVD-2020-33073)

Extreme CMS is an open source and free PHPCMS web content management system. A logic flaw vulnerability exists in Extreme CMS. Attackers can use the vulnerability to overstep their rights to delete or modify the database of other users goods...

Updated glpi packages fix security vulnerabilities

Updated glpi packages fix security vulnerabilities: In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges...

Slack: Stored XSS through PDF viewer

Slack allows users to upload files to their Workspace to facilitate sharing information between team members as well as with other workspaces. In addition, with the aim of easing access to PDF files, Slack provides its own "PDF Viewer" https://app.slack.com/pdf-viewer embedded in the application...

Exclusive: Hacker selling 500 million Facebook user data from 82 countries

By Waqas The entire database is being sold for $30,000 on a hacker forum. This is a post from HackRead.com Read the original post: Exclusive: Hacker selling 500 million Facebook user data from 82 countries...

Logic flaws exist in the YiYu enterprise building system vulnerability

Eyou content management system EyouCms belongs to Hainan Zanzan Network Technology Co., Ltd. is the newest PHP open source website management system. EyouCms has a logic flaw vulnerability that can be exploited by attackers to tamper with other users' information...

CVE-2020-12257

rConfig 3.9.4 is vulnerable to cross-site request forgery CSRF because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form add a user, delete a user, or edit a user...

keycloak: problem with privacy after user logout

A flaw was found in Keycloak. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section...

Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases

More than 4,000 Android apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information on their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. The investigation, led by Bob Diachenko...

CVE-2020-11033

In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges escalations or read/update/delete data normally non...

CVE-2020-11033

CVE-2020-11033 affects GLPI 9.1 up to before 9.4.6. An API user with READ on the User itemtype could query apirest.php/User and obtain the full user list, including all api_tokens (privilege escalation) and personal_tokens (inter-user planning). Exploitation requires the API to be enabled and a t...

Adult Cam Site CAM4 Exposed 10.88 Billion Records Online

CAM4 has taken the server offline, but not before it leaked 7TB of user data...

The vulnerability of Microprogrammed Software in Modicon Controllers arises from the existence of rigidly encrypted user data, which allows a intruder to execute any command against the Modicon Controllers.

The vulnerability of Microprogrammed Software in Modicon Controllers stems from the existence of rigidly encoded configuration data used to transmit configuration files to Modicon Controllers. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on Modicon...

The vulnerability of the Special:Redirect function in the MediaWikia hypertext environment allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Special:Redirect function in the MediaWiki software lies in the lack of protection for user-defined data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by searching for user identities...

PT-2020-4421

Name of the Vulnerable Software and Affected Versions: jQuery versions 1.0.3 through 3.4.1 Description: The issue arises from insufficient cleaning of user-provided data when passing HTML elements to jQuery's DOM manipulation methods, such as .html and .append. This can allow an attacker to execu...

CVE-2020-11822

CVE-2020-11822 affects Rukovoditel 2.5.2. The vulnerability is a stored XSS on the Application Structure module, specifically the User Access Groups page, enabling an attacker to inject malicious script and potentially steal user data. The connected documents do not provide specific exploit code,...

GitLab: Stored XSS in group issue list

Hello Gitlab! To reproduce the bug, we need to enable the "vueissuableslist" feature in Gitlab. This feature is not enabled by default, but I think it would be better to fix this issue before this feature is permanently available. Steps to reproduce: 1. Run Gitlab docker run --detach --hostname...

Xi'an Baolian Network Technology Co., Ltd. construction system has logical flaws and vulnerabilities

Xi'an BaiLian Network Technology Co., Ltd. is the first technology company specializing in bearing industry management software development and bearing industry portal design. There is a logic flaw vulnerability in the construction system of Xi'an Bailian Network Technology Co. Attackers take...

ECshop v4.06 H5 Micro Mall has a flawed logic vulnerability

ECshop is a B2C classic open source mall system . ECshop v4.06 H5 micro-mall there is a logic flaw vulnerability, attackers can exploit the vulnerability to obtain all the user information in the mall...