2622 matches found
Subsonic Cross-Site Request Forgery Vulnerability
Subsonic is a media file hosting platform developed and maintained by software developer Sindre Mehus. A cross-site request forgery vulnerability exists in Subsonic version 6.1.3. The vulnerability can be exploited to retrieve sensitive user information by tricking a user into visiting a website...
Cross site scripting
Subsonic v6.1.3 has an insecure allow-access-from domain="" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to ste...
CVE-2018-6014
Subsonic v6.1.3 has an insecure allow-access-from domain="" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to ste...
Subsonic v6.1.3 - Flash Cross-Domain Policy Vulnerability
Document Title: =============== Subsonic v6.1.3 - Flash Cross-Domain Policy Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2115 Video: https://www.youtube.com/watch?v=t3nYuhAHOMg http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6014...
Google Chrome Once Again Target of Malicious Extensions
Researchers at network security vendor ICEBRG recently discovered four malicious extensions in the official Google Chrome Web Store with a combined user count of more than 500,000, and as with past incidents, the implications are serious for both consumers and enterprises. ICEBRG notified Google...
CVE-2017-16893
The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected:...
Buffer overflow
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, userid, and token fields in data/data/com.ohmibod.remote2/sharedprefs/OMB.xml...
CVE-2017-16893
The application Piwigo is affected by an SQL injection vulnerability in version 2.9.2 and possibly prior. This vulnerability allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. tags.php is affected:...
CVE-2017-8216
Warsaw Huawei Smart phones with software of versions earlier than Warsaw-AL00C00B180, versions earlier than Warsaw-TL10C01B180 have a permission control vulnerability. Due to improper authorization on specific processes, an attacker with the root privilege of a mobile Android system can exploit...
CVE-2017-15864
In the Agent Frontend in Open Ticket Request System OTRS 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like database user and password...
Information Disclosure Via Tracking Module
botbait is a tool that can be used to track bot and automated tools usage within the npm ecosystem. The module tracks user information such as source IP, process.versions, process.platform and how the module was invoked test, require, pre-install...
Mathias Kettner Check_MK Information Disclosure Vulnerability
Mathias Kettner CheckMK is an open-source, general-purpose Nagios/Icinga monitoring system data collection plug-in from Mathias Kettner, Germany, which collects data from operating system and network components by employing a new methodology and supports the automated detection of monitoring item...
Disqus Hacked: More than 17.5 Million Users' Details Stolen in 2012 Breach
Another day, Another data breach disclosure. This time the popular commenting system has fallen victim to a massive security breach. Disqus, the company which provides a web-based comment plugin for websites and blogs, has admitted that it was breached 5 years ago in July 2012 and hackers stole...
CVE-2017-14955
CheckMK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report...
EUVD-2017-6431
CheckMK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report...
CVE-2017-14955
CheckMK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, which allows remote attackers to obtain sensitive user information by reading a GUI crash report...
About the security content of tvOS 10.2.2 - Apple Support
About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...
WordPress REST API Plugin Information Disclosure (CVE-2017-5487)
An information disclosure vulnerability exists in WordPress REST API Plugin. Successful exploitation could result in the disclosure of sensitive user information...
Ocean Cms V6.54 admin_datarelate.php parameter has SQL injection vulnerability
Ocean Movie System aka Ocean CMS seacms is a PHP movie system. Ocean CMS V6.54 admindatarelate.php parameter SQL injection vulnerability exists, the vulnerability is due to the system failed to user-submitted parameters for effective filtering. An attacker can use this vulnerability to obtain...
CentOS 7 : authconfig (CESA-2017:2285)
An update for authconfig is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...