Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Ibexa Ezplatform-Graphql

CVE-2022-41876 - eZ Platform user information disclosure A vu...

PT-2023-15415 · Unknown · Mickael Austoni Map Multi Marker

Name of the Vulnerable Software and Affected Versions: Mickael Austoni Map Multi Marker plugin versions = 3.2.1 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially allowing them to steal user...

Facebook illegally processed user data, says court

The Amsterdam court has ruled that Facebook illegally processed user data in a case started by the Dutch Data Privacy Stichting DPS, a foundation that acts on behalf of victims of privacy violations in the Netherlands. According to the ruling, Facebook used personal data for advertising purposes ...

PT-2023-21567 · Docker · Play With Docker

Name of the Vulnerable Software and Affected Versions: Play With Docker versions 0.0.2 and prior Description: Play With Docker is a browser-based Docker playground. The issue arises from incorrect CORS configuration, allowing an attacker to bypass the CORS policy by setting the origin header in a...

CVE-2020-4927

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

Code injection

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

CVE-2020-4927 IBM Spectrum Scale information disclosure

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

Authorization

An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems ST-PI - versions 20881700, 20081710, 740, can use a vulnerable interface to execute an application function to perform actions which they...

Online Food Ordering System 跨站请求伪造漏洞

Online Food Ordering System is an online food ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Food Ordering System version 1.0, which stems from a cross-site request forgery CSRF vulnerability. The vulnerability can be exploited by an attacker ...

CSV Injection in CSV files generated by the backend

1 login in https://demo.limesurvey.org/index.php 2 the demo admin create a user with name "=1+cmd|'/C calc'!A0". 4 other users login and download all the users' data as csv. 5 other users open the csv file with execl in windows, notice that choose ";" as separator as. 6 we can see that the...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale which could allow unauthorized access to user data or injection of arbitrary data in the communication protocol (CVE-2020-4927)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale which could allow unauthorized access to user data or injection of arbitrary data in the communication protocol . This vulnerability only affects Spectrum Scale clusters that host file systems. Clusters that...

PT-2023-21005 · Unknown · Best Pos Management System

Name of the Vulnerable Software and Affected Versions: Best POS Management System version 1.0 Description: A cross-site scripting XSS issue exists in the /kruxton/navbar.php file, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter...

PT-2023-19954 · Discourse · Discourse Yearly Review Plugin

Name of the Vulnerable Software and Affected Versions: Discourse Yearly Review plugin affected versions not specified Description: The Discourse Yearly Review plugin has an issue where a user present in a yearly review topic that is then anonymized will still have some data linked to its original...

PT-2023-16804 · Unknown · Icret/Easyimages2.0

Name of the Vulnerable Software and Affected Versions: icret/easyimages2.0 versions prior to 2.6.7 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing attackers to inject malicious scripts...

CVE-2021-45478

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2...

YORDAM University Library Automation System 安全漏洞

YORDAM University Library Automation System is a university library automation system from YORDAM. A security vulnerability exists in the YORDAM University Library Automation System prior to version 19.2, which stems from mishandling of the system's parameters and allows the collection of...

YORDAM University Library Automation System 安全漏洞

YORDAM University Library Automation System is a university library automation system from YORDAM. A security vulnerability exists in the YORDAM University Library Automation System prior to version 19.2, which stems from mishandling of the system's parameters and allows the collection of...

YORDAM University Library Automation System 跨站脚本漏洞

YORDAM University Library Automation System is a university library automation system from YORDAM. A security vulnerability exists in the YORDAM University Library Automation System prior to version 19.2, which stems from mishandling of the system's parameters and allows the collection of...

keycloak: user impersonation via stolen uuid code

A flaw was found in Keycloak's OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issu...

Video Marketing Software Animker Leaking Trove of User Data

By Waqas At the time of publishing this article, the database has continued to grow with new data. This is a post from HackRead.com Read the original post: Video Marketing Software Animker Leaking Trove of User Data...