1971 matches found
Delta Rm Authorization Issue Vulnerability
Delta Rm is a simple and effective risk management from Delta Rm France. It is used to simplify risk management methods and save time. A security vulnerability exists in Delta RM 1.2, which could use this account ID to request a new password for any other account. Using the list DTsendmaildata ad...
CVE-2021-44839
An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/admutilisateur/send-mail.json endpoint, a user can send a JSON array with user IDs that will have their passwords reset and new ones sent ...
CVE-2020-35215
creationtimestamp| type| source ---|---|--- 2021-12-16 22:36:11+00:00| seen| https://t.me/cibsecurity/34167...
Tuleap 注入漏洞
Enalean Tuleap is a set of open source software development and project management tools from the French company Enalean. The tool provides enterprise application lifecycle management, as well as project tracking, source code management, and team collaboration.Enalean Tuleap suffers from an...
Tuleap 注入漏洞
Enalean Tuleap is a set of open source software development and project management tools from the French company Enalean. The tool provides enterprise application lifecycle management, as well as project tracking, source code management, and team collaboration.Enalean Tuleap suffers from an...
CVE-2021-39063
creationtimestamp| type| source ---|---|--- 2021-12-13 22:12:23+00:00| seen| https://t.me/cibsecurity/33885...
FetLife: Able to access private picture/video/writing when requesting for their JSON response
Description Endpoint https://fetlife.com/users/user-id/pictures/pic-id has 2 types of responses, HTML and JSON. The type of response depends on Accept header of request it get. If request contains Accept: application/json, then it will return JSON response. Other than that, it returns HTML...
CVE-2021-37086
There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers which can isolate and read synchronization files of other applications across the UID sandbox...
PT-2021-4989 · Mcafee · Mcafee Policy Auditor
Name of the Vulnerable Software and Affected Versions: McAfee Policy Auditor versions prior to 6.5.2 Description: The issue is related to a Reflected Cross-Site Scripting vulnerability in the web interface of McAfee Policy Auditor. This vulnerability allows a remote unauthenticated attacker to...
Information disclosure
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or...
CVE-2021-24647 Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or userna...
CVE-2021-37990
creationtimestamp| type| source ---|---|--- 2021-11-03 01:23:15+00:00| seen| https://t.me/cibsecurity/31673...
CVE-2021-41022
creationtimestamp| type| source ---|---|--- 2021-11-02 21:23:23+00:00| seen| https://t.me/cibsecurity/31632...
Urban Company: Critical full compromise of jarvis-new.urbanclap.com via weak session signing
Summary Hi there, I discovered that jarvis-new.urbanclap.com uses a weak Flask session key. Because Flask sessions are signed with a static secret, if this secret is known to an attacker then they can modify the session state. In this case, we can modify the Redash userid for the session and log ...
Desdev DedeCMS 跨站脚本漏洞
DedeCMS Dream Weaving Content Management System is a set of simple, robust, flexible, open source several characteristics of open source content management system. DedeCMS has a cross-site scripting vulnerability that can be exploited to inject malicious script code via the filename, mid, userid ...
ANCOM WLAN Controller WLC-1000 跨站脚本漏洞
The ANCOM WLAN Controller WLC-1000 is an industrial control system. A security vulnerability exists in the ANCOM WLAN Controller WLC-1000 and WLC-4006 that allows an attacker to include multiple cross-site scripting vulnerabilities in the "/authen/start/" module via the user ID and password...
Open Solutions For Education OpenSis-Classic SQL注入漏洞
openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in openSIS version 8.0. The vulnerability stems from a lack of validation of input data for the $GET'usrid' and $GET'profid' parameters in PasswordCheck.php. An attacker can...
WordPress Pie Register 3.7.1.4 Plugin - Admin Privilege Escalation Vulnerability
Exploit Title: WordPress Plugin Pie Register 3.7.1.4 - Admin Privilege Escalation Unauthenticated Google Dork: inurl:/plugins/pie-register/ Exploit Author: Lotfi13-DZ Vendor Homepage: https://wordpress.org/plugins/pie-register/ Software Link:...
