Agent can get inbox credentials through api

Description user with agent privileges can get access to sensitive inbox details through api Proof of Concept 1. Create normal user with agent privileges 2. get api key for this user 3. use endpoint https://www.chatwoot.com/developers/api/tag/Inboxes/operation/listAllInboxes 4. if inbox is...

Sofia-SIP: Multiple Vulnerabilities

Background Sofia-SIP is an RFC3261 compliant SIP User-Agent library. Description Multiple vulnerabilities have been discovered in Sofia-SIP. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no know...

User-Agent Reduction

Chrome is rolling out changes to the browser’s User-Agent string that will affect how web servers, applications, and CDNs like Akamai gather information about the current user agent such as the browser’s version, device, and platform information...

PartyLoud - A Simple Tool To Generate Fake Web Browsing And Mitigate Tracking

PartyLoud is a highly configurable and straightforward free tool that helps you prevent tracking directly from your linux terminal, no special skills required. Once started, you can forget it is running. It provides several flags; each flag lets you customize your experience and change PartyLoud...

Two Weeks of Monitoring ProxyNotShell (CVE-2022-41040 & CVE-2022-41082) Threat Activity

The Wordfence Threat Intelligence team has been monitoring exploit attempts targeting two zero-day vulnerabilities in Microsoft Exchange Server tracked as CVE-2022-41040 and CVE-2022-41082, collectively known as ProxyNotShell. These vulnerabilities are actively being exploited in the wild. At the...

Wordpress ImageMagick-Engine 1.7.4 Plugin - Remote Code Execution (Authenticated) Exploit

Exploit Title: Wordpress Plugin ImageMagick-Engine 1.7.4 - Remote Code Execution RCE Authenticated Google Dork: inurl:"/wp-content/plugins/imagemagick-engine/" Date: Thursday, September 1, 2022 Exploit Author: ABDO10 Vendor Homepage: https://wordpress.org/plugins/imagemagick-engine/ Software Link...

Threat Advisory: CVE-2022-40684 Fortinet Appliance Auth bypass

This morning, the Wordfence Threat Intelligence team began tracking exploit attempts targeting CVE-2022-40684 on our network of over 4 million protected websites. CVE-2022-40684 is a critical authentication bypass vulnerability in the administrative interface of Fortinet’s FortiGate firewalls,...

ZKSecurity BIO 3.0.5.0_R Privilege Escalation Vulnerability

ADVISORY INFORMATION Product: ZKSecurity BIO Vendor: ZKTeco Version Affected: 3.0.5.0R CVE: CVE-2022-36634 Vulnerability: User privilege escalation CREDIT This vulnerability was discovered and researched by Caio Burgardt and Silton Santos. INTRODUCTION Based on the hybrid biometric technology and...

CVE-2021-42045

An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote...

CVE-2021-42045

An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote...

Design/Logic Flaw

An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Agent HTTP header and submitting a vote...

Nextcloud: [user_oidc] Stored XSS via Authorization Endpoint - Safari-Only

Summary: The OpenID Connect User Backend allows users to login to Nextcloud using SSO. A workaround that was apparently implemented for the Safari browser enables stored Cross-Site-Scripting XSS. The vulnerability only affects user agents that include "Safari" within their user agent string and i...

CVE-2022-36530

An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page...

CVE-2022-36530

An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page...

Code injection

An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page...

CVE-2022-36530

CVE-2022-36530 affects rageframe2 version 2.6.37, describing an XSS vulnerability in the user agent related parameters of the info.php page. The cited sources consistently indicate this is a cross-site scripting issue, but do not provide explicit exploit details, affected build ranges beyond 2.6....

rageframe2 跨站脚本漏洞

rageframe2 is a rapid development application engine based on the Yii2 Advanced Framework by the individual developer Jianyan74. A security vulnerability exists in rageframe2 version 2.6.37, which is caused by an XSS vulnerability in the user-agent related parameters of the info.php page...

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Description The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session Proof of Concept PHPSESSID:"ID" Created:"Tue, 19 Jul 2022 13:15:32 GMT" Domain:"demo.pimcore.fun" Expires / Max-Age:"Sessio...

CVE-2022-34278

creationtimestamp| type| source ---|---|--- 2022-07-12 14:20:13+00:00| seen| https://t.me/cibsecurity/45971...

MAL-2022-4589 Malicious code in middleware-user-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44b19794566bda4a38dd2d540097a33b1e703d4edd266ebcbf86146a996fb8a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...