CVE-2020-14274

CVE-2020-14274 affects HCL Commerce 9.0.1.9–9.0.1.14 and 9.1–9.1.4, causing information disclosure of user personal data. The root cause and vectors are not specified in the provided documents; exploitation status is not detailed. No remediation steps are listed in these sources. Monitor for upda...

CVE-2020-14275

The CVE-2020-14275 entry concerns HCL Commerce, affecting versions 9.0.0.5–9.0.0.13, 9.0.1.0–9.0.1.14, and 9.1–9.1.4. It states potential denial of service, disclosure of user personal data, and the ability to perform unauthorized administrative operations. No root-cause, affected component/file,...

Post-Backlash, WhatsApp Spells Out Privacy Policy Updates

WhatsApp is making explicit clarifications around its updated privacy policy, after reports ran amok about the messaging app mandating all-encompassing data-sharing with parent company Facebook. The app’s new privacy policy and terms of service, which will go into effect Feb. 8, says that WhatsAp...

Changes in WhatsApp’s Privacy Policy

If youre a WhatsApp user, pay attention to the changes in the privacy policy that youre being forced to agree with. In 2016, WhatsApp gave users a one-time ability to opt out of having account data turned over to Facebook. Now, an updated privacy policy is changing that. Come next month, users wi...

Adobe Acrobat and Reader Information Disclosure Vulnerability (CNVD-2021-02375)

Adobe Acrobat and Adobe Reader are the United States of America Odo than Adobe company's products. Adobe Acrobat is a set of PDF file editing and conversion tools. Adobe Reader is a set of PDF document reading software. Adobe Acrobat and Reader have information disclosure vulnerabilities, an...

CVE-2020-35745

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...

Code injection

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...

CVE-2020-35745

PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, doctors, patients, change admin password, get appointment history and access all session logs...

Facebook’s Mandatory Data-Sharing Rules for WhatsApp Spark Ire

WhatsApp is asking users to accept a new privacy policy that will share all of their data with Facebook beginning Feb. 8, a move that has users sounding an alarm once again about the privacy of their information in the hands of the social media giant. The Facebook-owned messaging service already...

PHPGurukul Hospital Management System Information Disclosure Vulnerability

PHPGurukul Hospital Management System is a PHP and MySQL based hospital management system. A security vulnerability exists in PHPGURUKUL Hospital Management System V 4.0, which can be exploited by an attacker to gain access to all user, doctor, and patient data, change administrator passwords,...

Expense Tracker 1.0 Cross Site Scripting

Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2021-01-05 Vendor Homepage: https://code-projects.org/expense-tracker-in-php-with-source-code/ Software Link: https://code-projects.org Version: 1.0 Category: Web Applicatio...

Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting

Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2021-01-05 Vendor Homepage: https://code-projects.org/expense-tracker-in-php-with-source-code/ Software Link: https://code-projects.org Version: 1.0 Category: Web Applicatio...

Buffer Overflow Vulnerability in Cisco RV110W Products (CNVD-2021-05411)

The Cisco RV110W Wireless-N VPN Firewall is an enterprise-class router from Cisco USA. The Cisco RV110W product suffers from a buffer overflow vulnerability that originates from a program's failure to properly validate user data, which can be exploited by a remote attacker to execute arbitrary co...

CVE-2019-20483

An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application...

Click2Magic 1.1.5 - Stored Cross-Site Scripting

Exploit Title: Click2Magic 1.1.5 - Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2020-12-25 Google Dork: N/A Vendor Homepage: https://www.click2magic.com/user/agent/index Software Link: https://www.click2magic.com Version: 1.1.5 Category: Web Application Tested on: Kali...

Mantis Bug Tracker 2.24.3 - 'access' SQL Injection

Exploit Title: Mantis Bug Tracker 2.24.3 - 'access' SQL Injection Date: 30/12/2020 Exploit Author: EthicalHCOP Vendor Homepage: https://www.mantisbt.org/ Version: 2.24.3 CVE: CVE-2020-28413 import requests, sys, time from lxml import etree proxies = "http": "http://127.0.0.1:8080", "https":...

CVE-2020-35934

The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object including all metadata upon login via the REST API aam/v1/authenticate or aam/v2/authenticate. This is a security problem if this object stores information that the user is not supposed to have e.g.,...

PT-2021-11868 · WordPress · Aam Advanced Access Manager

Name of the Vulnerable Software and Affected Versions: Advanced Access Manager plugin versions prior to 6.6.2 Description: The issue arises when the Advanced Access Manager plugin for WordPress displays the unfiltered user object, including all metadata, upon login via the REST API at endpoints...

ASB-A-129287265

In Account of Account.java, there is a possible boot loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

WordPress 处理逻辑错误漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Advanced Access Manager plugin versions prior to 6.6.2,...