CVE-2024-55416

Summary: CVE-2024-55416 affects DevDojo Voyager up to version 1.8.0. The issue is a reflected Cross-Site Scripting (XSS) vulnerability triggered via the /admin/compass endpoint, requiring an authenticated user to click a crafted link. The attack can execute arbitrary JavaScript in the administrat...

CVE-2024-55416

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed...

CVE-2024-55417

DevDojo Voyager through version 1.8.0 is vulnerable to bypassing the file type verification when an authenticated user uploads a file via /admin/media/upload. An authenticated user can upload a web shell causing arbitrary code execution on the server...

PT-2025-1306 · Devdojo · Devdojo Voyager

Name of the Vulnerable Software and Affected Versions: DevDojo Voyager versions 1.8.0 and earlier Description: The issue allows an authenticated user to bypass file type verification when uploading a file via the "/admin/media/upload" endpoint. This can lead to the upload of a web shell, resultin...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload at the /admin/media/upload, which checks file types in the upload function. An authenticated user with the browsemedia privilege can provide a file spoofing one of the allowedMimeTypes, that contains malicious code...

store.voyager.co.jp Cross Site Scripting vulnerability OBB-3828451

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

LinkedInDumper - Tool To Dump Company Employees From LinkedIn API

Python 3 script to dump company employees from LinkedIn API Description LinkedInDumper is a Python 3 script that dumps employee data from the LinkedIn social networking platform. The results contain firstname, lastname, position title, location and a user's profile link. Only 2 API calls are...

voyagerinsurance.com Cross Site Scripting vulnerability OBB-3280197

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Remote code execution in Voyager

Insecure Permission vulnerability found in Voyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component...

GHSA-2X3R-7JGM-GH8X Remote code execution in Voyager

Insecure Permission vulnerability found in Voyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component...

Voyager 安全漏洞

Voyager is an application by David Borland Personal Developer. A security vulnerability exists in Voyager version v.1.4 and earlier versions, which stems from the presence of an insecure privilege vulnerability. An attacker can exploit this vulnerability to execute arbitrary code via specially...

PT-2023-11800 · Voyager · Voyager

Name of the Vulnerable Software and Affected Versions: Voyager versions 1.4 and earlier Description: The issue allows a remote attacker to execute arbitrary code via a crafted .php file to the media component. This is due to an Insecure Permission vulnerability. Recommendations: For Voyager...

"Untraceable" surveillance firm sued for scraping Facebook and Instagram data

Days after Meta achieved victory after suing the NSO Group for Computer Fraud and Abuse Act charges, Meta filed a lawsuit against surveillance company Voyager Labs for violations of its Terms and Policies and California law. According to court documents, Voyager Labs created 38,000 fake accounts ...

CVE-2014-125074

A vulnerability was found in Nayshlok Voyager. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql injection. The identifier of the patch is...

Sql injection

A vulnerability was found in Nayshlok Voyager. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql injection. The identifier of the patch is...

CVE-2014-125074 Nayshlok Voyager DatabaseAccess.java sql injection

A vulnerability was found in Nayshlok Voyager. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql injection. The identifier of the patch is...

CVE-2014-125074

CVE-2014-125074 affects Nayshlok Voyager, specifically the file Voyager/src/models/DatabaseAccess.java. The vulnerability arises from a manipulation that leads to SQL injection. The patch identifier is f1249f438cd8c39e7ef2f6c8f2ab76b239a02fae, and the vulnerability is associated with patch/VDB-21...

PT-2023-10144 · Unknown · Nayshlok Voyager

Name of the Vulnerable Software and Affected Versions: Nayshlok Voyager affected versions not specified Description: A critical vulnerability was found in Nayshlok Voyager, affecting an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql...

Voyager SQL注入漏洞

Voyager is an application by David Borland, an individual developer. Voyager suffers from a SQL injection vulnerability. An attacker could exploit this vulnerability to perform a sql injection attack...

LinkedIn: IDOR to make someone attend or leave an event

An Insecure Direct Object Reference IDOR vulnerability was discovered in LinkedIn's event attendance functionality. The vulnerability allowed an attacker to manipulate event attendance by modifying the fsdprofile parameter in POST requests to the voyagerScheduledcontentDashViewerStates API...