MediaWiki CentralAuth Information Disclosure Vulnerability

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. The product can be used to deploy in-house knowledge management and content management systems. centralAuth is one of the extensions that supports shared global...

Microsoft SharePoint Information Disclosure (CVE-2019-1443)

An information disclosure vulnerability exists in Microsoft SharePoint. Successful exploitation of this vulnerability could result in the disclosure of sensitive user information...

CVE-2019-12520

An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...

About the security content of iCloud for Windows 7.16 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

Zomato: [www.zomato.com] Blind SQL Injection in /php/geto2banner

Hi Team! Our team discovered a Blind SQL Injection by Abusing LocalParams resid in /php/geto2banner We are working to create a full PDF Report as an WriteUp ; Here is a Temporal Exploit based on the Vulnerable request: POST /php/geto2banner HTTP/1.1 Host: www.zomato.com Connection: close...

Authentication flaw

For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentia...

Privilege escalation

An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive information about all users registered on the system. This includes their full name, privilege, email address, phone number, etc...

CVE-2020-3921

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

Information disclosure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3921 Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

CVE-2020-3921 Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page...

Unauthorized Access Vulnerability in Kodak Multimedia Recording and Playback System

Ltd. is a provider of video and security products and solutions, dedicated to video conferencing, video surveillance and video application solutions to help various government and enterprise customers to solve visual communication and management challenges. An unauthorized access vulnerability...

360 P0 and F5C Licensing Issues Vulnerabilities

The Qihoo 360 P0 and 360 F5C are both wireless routers from the Chinese company Qihoo Technologies. An authorization issue vulnerability exists in the interfaces of the 360 P0 and F5C, which can be exploited by an attacker to obtain some of the user's information, cause the user to be unable to u...

Logic flaws in the Shen Yueh Housing Provident Fund business system

Shen Yue Software is a company that provides housing fund management software. A logic flaw vulnerability exists in the Shen Yue housing fund business system, which can be exploited by attackers to reset user information and view sensitive user information...

Microsoft Office Excel Information Disclosure (CVE-2019-1110)

An information disclosure vulnerability exists in Microsoft Office Excel. Successful exploitation of this vulnerability could result in the disclosure of sensitive user information...

SOPlanning 1.45 - 'by' SQL Injection

Exploit Title: SOPlanning 1.45 - 'by' SQL Injection Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/ Version 1.45 Tested on Windows 10/Kali Rolling The SOPlanning application i...

Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Exploit

Exploit for java platform in category web applications Exploit Title: Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation Discovered by: Elwood Buck & Nolan B. Kennedy of Mindpoint Group Exploit Author: Nolan B. Kennedy nxkennedy Discovery date: 2019-09-20 Vendor Homepage:...

Welp – Google sent your photos & videos to strangers

By Uzair Amir Not a Good news for Google Takeout users. Were you photos or videos were also shared by Google with strangers? This is a post from HackRead.com Read the original post: Welp - Google sent your photos & videos to strangers...

Topcoder: PII of Users Disclosure using "/members/invite/" endpoint

Hello! I found PII Disclosue at https://connect.topcoder.com/projects/ Steps to Reproduce. 1 Go to https://connect.topcoder.com/projects 2 Select an existing project, or create a new one. 3 Select the "Manage Invitations" option. on the left sidebar. 4 Enter the Username/Email of the user you wan...

Centreon 19.10.5 - Pollers Remote Command Execution

Centreon 19.10.5 - Pollers Remote Command Execution Exploit Title: Centreon 19.10.5 - 'Pollers' Remote Command Execution Date: 2020-01-27 Exploit Author: Omri Baso, Fabien Aunay Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested...