CVE-2020-9976

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0. A malicious application may be able to leak sensitive user information...

Cross-Site Scripting (XSS)

pterodactyl/panel is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via user information such as name and email...

Small CRM 2.0 - 'email' SQL Injection

Exploit Title: Small CRM 2.0 - 'email' SQL Injection Google Dork: N/A Date: 2020-10-10 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/small-crm-php/ Version: V2.0 Tested on: Kali Linux CVE : N/A ========== Vulnerable Code =========...

U.S. Dept Of Defense: View another user information with IDOR vulnerability

1- Navigate to the system. https://███████/login.php 2- Navigate to register page. https://██████████/register.phpi created user, username:██████ pass: TEst.123.! 3- Login to the system. https://███/login.php 4- Navigate to "My Profile Page". 5- Intercept the request. 6- Change the "UID2=4820038"...

MediaWiki Special:UserRights Code Issue Vulnerability

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. MediaWiki has a code issue vulnerability that can be exploited by attackers t...

CVE-2020-15217

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ...

CVE-2020-15217

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ...

Design/Logic Flaw

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ...

CVE-2020-15217

GLPI CVE-2020-15217: In GLPI before 9.5.2, a leakage of user information via the public FAQ was introduced in 9.5.0 and fixed in 9.5.2. Patch available in 9.5.2+; workaround is to disable public access to the FAQ. Connected sources also describe additional GLPI flaws (XSS, SSRF, privilege/authori...

GHSA-38HX-3542-8FH3 Malicious code in `electorn`

npm packages loadyaml and electorn were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information: - IP and IP-based geolocation - home directory name - local...

CVE-2019-16007 Cisco AnyConnect Secure Mobility Client for Android Service Hijack Vulnerability

A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to perform a service hijack attack on an affected device or cause a denial of service DoS condition. The vulnerability is due to the use of...

OPENSUSE-SU-2020:1439-2 Security update for mumble

This update for mumble fixes the following issues: mumble was updated 1.3.2: client: Fixed overlay not starting Update to upstream version 1.3.1 - Security Fixed: Potential exploit in the OCB2 encryption 4227 boo1174041 - ICE Fixed: Added missing UserKDFIterations field to UserInfo = Prevents...

Siemens Siveillance Video Client User Information Disclosure Vulnerability

Siveillance Video formerly known as Siveillance VMS is an IP video management software. A security vulnerability exists in the Siemens Siveillance Video Client. An attacker could exploit the vulnerability to obtain a valid administrator login and use this information to launch further attacks...

GHSA-2563-83P7-F34P Malicious Package in requestt

All versions of requestt typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process...

GHSA-855M-JCHH-9QJC Malicious Package in commnader

All versions of commnader typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process...

Malicious Package in commnader

All versions of commnader typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process...

Malicious Package in exprss

All versions of exprss typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

GHSA-6QC7-JGQ7-34RF Malicious Package in exprss

All versions of exprss typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

GHSA-FPW3-X4XQ-6VXQ Malicious Package in wepack-cli

All versions of wepack-cli typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the proces...

Tracking Module in botbait

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. - Source IP - process.versions - process.platform - How the module was invoked test, requir...