CVE-2021-26593

In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/id. For each call, they get in response a lot of information about the user such as email address, first name, and last name but also the secret for 2FA if one exists. This secret can be regenerated. NOTE...

Design/Logic Flaw

UNSUPPORTED WHEN ASSIGNED In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/id. For each call, they get in response a lot of information about the user such as email address, first name, and last name but also the secret for 2FA if one exists. This secre...

XSS Vulnerability in JTopCMS of Hefei Mingjing Information Technology Co.

JTopCMS is based on the JavaEE standard , used to manage site content of the open source web management system . Hefei Mingjing Information Technology Co., Ltd. JTopCMS XSS vulnerability, attackers can use the vulnerability to obtain sensitive information such as user cookies...

XSS Vulnerability in JTopCMS of Hefei Mingjing Information Technology Co. Ltd (CNVD-2021-15841)

JTopCMS is based on the JavaEE standard , used to manage the site content of the open source web management system . Hefei Mingjing Information Technology Co., Ltd. JTopCMS XSS vulnerability, attackers can use the vulnerability to obtain sensitive information such as user cookies...

A vulnerability exists in the Android version of the Miramar app that does not disable app debugging privileges.

The Beauty Talk app is a software used for online shopping. A vulnerability exists in the Android version of Meilizhou app where the APP debugging privilege is not closed. Attackers can use the vulnerability to debug the app to obtain sensitive user information...

CVE-2021-3176

The chat window of the Mitel BusinessCTI Enterprise MBC-E Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view...

CVE-2021-3176

The chat window of the Mitel BusinessCTI Enterprise MBC-E Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view...

Input validation

The chat window of the Mitel BusinessCTI Enterprise MBC-E Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view...

CVE-2021-3176

The chat window of the Mitel BusinessCTI Enterprise MBC-E Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to user information by sending certain code, due to improper input validation of http links. A successful exploit could allow an attacker to view...

newbee-mall Access Control Error Vulnerability

newbee-mall is an e-commerce system. An access control error vulnerability exists in all versions of newbee-mall, where an attacker cannot remotely gain privileges via NewBeeMallIndexConfigServiceImpl. java, but can make unauthorized changes to any user information via userID...

Information leakage vulnerability in YzmCMS

YzmCMS is a lightweight open source content management system based on PHP Mysql architecture, YzmCMS can run on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS information leakage vulnerability , attackers can use the vulnerability to obtain sensitive user information...

CVE-2020-23449

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID...

Design/Logic Flaw

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID...

CVE-2020-23449

newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID...

newbee-mall 访问控制错误漏洞

newbee-mall is an e-commerce system. An access control error vulnerability exists in all versions of newbee-mall, where an attacker cannot remotely gain privileges via NewBeeMallIndexConfigServiceImpl. java, but can make unauthorized changes to any user information via userID...

About the security content of tvOS 14.4

About the security content of tvOS 14.4 This document describes the security content of tvOS 14.4. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Shopify: [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserTfaEnforcement

Summary: There is an access control issue that happens when a Shopify Plus user tries to update the 2FA requirement of a user in another organisation. While the response shows an error message, an email is sent to the user with the 2FA status, first name, last name, email address, and shop id fro...

Fingerprint authentication loophole exists in Traffic Control 12321 APP (ios version)

Traffic control 12123 is the official client of the Internet traffic safety comprehensive service management platform, powered by the Ministry of Public Security's Institute of Traffic Management Science. There is a fingerprint authentication loophole in the Traffic Control 12321 APP ios version,...

CVE-2021-21722

A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulnerability to obtain sensitive user information for further information detection and attacks. This affects: ZXV10 B860A V2.1-TV0032.1.1.04jiangsuTelecom...

Information disclosure

A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulnerability to obtain sensitive user information for further information detection and attacks. This affects: ZXV10 B860A V2.1-TV0032.1.1.04jiangsuTelecom...