Design/Logic Flaw

An issue was discovered in Telexy QPath 5.4.462. A low privileged authenticated user supplying a specially crafted serialized request to AdanitDataService.svc may modify user information, including but not limited to email address, username, and password, of other user accounts. The simplest atta...

CVE-2018-7718

An issue was discovered in Telexy QPath 5.4.462. A low privileged authenticated user supplying a specially crafted serialized request to AdanitDataService.svc may modify user information, including but not limited to email address, username, and password, of other user accounts. The simplest atta...

CVE-2018-7718

An issue was discovered in Telexy QPath 5.4.462. A low privileged authenticated user supplying a specially crafted serialized request to AdanitDataService.svc may modify user information, including but not limited to email address, username, and password, of other user accounts. The simplest atta...

CVE-2018-7718

CVE-2018-7718 affects Telexy QPath 5.4.462 where a low-privileged, authenticated user can craft a serialized request to AdanitDataService.svc to modify e.g. email, username, or password of other accounts. The documented attack path suggests intercepting a password-change request and altering the ...

OLX: XSS Reflected at SEARCH >>

I have Found XSS payload avaliable at GET Request.. Live PoC URL:...

DedeCMS has information leakage vulnerability

Dream Content Management System DedeCMS is a PHP open source website management system. An information disclosure vulnerability exists in DedeCMS. An attacker can exploit the vulnerability to obtain sensitive user information that is publicly available on some websites...

FeiFeiCms 4.0.181010 version of the foreground there are logic flaws vulnerability

FeiFeiCms is developed by PHP+Mysql technology and can run on windows and Linux system platform. A logic flaw exists in the frontend of FeiFeiCms version 4.0.181010, which stems from a failure to properly filter user input and can be exploited by an attacker to modify user information...

Apache Ignite communicates to an external PHP server where sensitive information is sent

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server http://ignite.run where it needs to send...

Academic Timetable Final Build 7.0 - Information Disclosure Exploit

Exploit for php platform in category web applications \n"; printr$ver; echo "\n"; / Array sEcho = 10 iTotalRecords = 3 iTotalDisplayRecords = 3 aaData = Array 0 = Array 0 = testdb1 1 = testdb1 2 = ADMIN 3 = 6CC4E8CFFEAF202D7475BC906612F9A29A9C8117 1 = Array 0 = ADMIN 1 = admin...

30 Million Facebook Accounts Were Hacked: Check If You're One of Them

Late last month Facebook announced its worst-ever security breach that allowed an unknown group of hackers to steal secret access tokens for millions of accounts by taking advantage of a flaw in the 'View As' feature. At the time of the initial disclosure, Facebook estimated that the number of...

Stored Cross-Site Scripting Vulnerability at User Information Modification in Five Fingers CMS

Five Fingers CMS is an open source content management system that supports LNAMP architecture. A stored cross-site scripting vulnerability exists in Five Fingers CMS at the modification of user information. Attackers can insert malicious js code in the page to obtain user cookies and other...

Chaturbate: View Failed Approval and Pending videos other users

See videos uploaded by a user. The video is available when it waits for confirmation or is not accepted. Steps To Reproduce: 1 - Go victim page : https://chaturbate.com/p/akaxanxa/?tab=bio 2 - Open video : https://chaturbate.com/photovideos/photo/big/username/contentid/ 3 - Get random requests -...

SQL Injection Vulnerability in the User Information Modification Interface of S-CMS School Building System

S-CMS school station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. A SQL injection vulnerability exists in the user information modification interface of S-CMS. An attacker can exploit the vulnerability ...

See how I found the Yahoo XSSi vulnerability to achieve the user information stealing-vulnerability warning-the black bar safety net

! Find some specific categories of vulnerability is composed of two key parts, that is the vulnerability the cognitive as well as mining the degree of difficulty. Cross-site script contains a vulnerabilityXSSi in a recognized security standards OWASP TOP 10 and is not mentioned, but it is also no...

Jumpstart your Microsoft Graph Security API integration with the new JavaScript sample app

The Microsoft Graph Security API, which launched this spring, is a unified REST API for integrating data and intelligence from Microsoft products, services, and partners. Using Microsoft Graph, developers can easily build applications that consolidate and correlate security alerts from multiple...

Apple Mac OS X Security Updates (HT208937)-01

Apple Mac OS X is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: User information can appear in the system audit log on the IBM SONAS (CVE-2014-3077)

Summary A fix is available for the IBM SONAS, for the security issue that user information is displayed in system audit log Vulnerability Details CVEID: CVE-2014-3077 DESCRIPTION: Under some circumstances, user details appear in the system log. An attacker could exploit this vulnerability to gain...

Tapplock Smart Lock Insecure Direct Object Reference

The server http://api.tapplock.com/ which servers as the api server for the tapplock smart lock is vulnerable to multiple authorization bypasses allowing horizontal escalation of privileges which could lead to the disclosure of all the info of all users and total compromise of every lock. The...

Oracle Sun GlassFish Enterprise Server CSRF Vulnerability

Oracle GlassFish Enterprise Server is an open source and open community platform for building and deploying next-generation applications and services. A CSRF vulnerability exists in Oracle Sun GlassFish Enterprise Server, which can be exploited by an attacker to steal user information...

CVE-2018-2424

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided JavaScript code being added to the DOM that could steal user information. Software components affected are: SAP Hana Database 1.00, 2.00; SAP UI5 1.00; SAP UI5 Java 7.30, 7.31, 7.40...