CVE-2021-25755

In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic...

CVE-2021-25755: Undefined Security Weakness

In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic...

PT-2021-16767

Name of the Vulnerable Software and Affected Versions JetBrains Code With Me versions prior to 2020.3 Description The issue allows an attacker on the local network, who knows a session ID, to access encrypted traffic. Recommendations For versions prior to 2020.3, update to version 2020.3 or later...

JetBrains Code With Me 安全漏洞

JetBrains Code With Me is a plug-in application from the Czech company JetBrains that provides code co-editing for the IntelliJ IDE. JetBrains Code With Me suffers from a cryptographic issue vulnerability that can be exploited by an attacker on the local network to access encrypted traffic knowin...

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. PoC The plugin must have a valid purchase code for the request to work curl -X GET --header 'Content-Type: application/json' --header...

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. The plugin must have a valid purchase code for the request to work curl -X GET --header 'Content-Type: application/json' --header 'Accept:...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none...

PT-2021-11742

Name of the Vulnerable Software and Affected Versions: Student Result Management System In PHP With Source Code affected versions not specified Description: The issue allows an attacker to access the Admin Panel and manage every account of Result through SQL injection. Recommendations: At the...

CVE-2020-35270: Improper Neutralization of Special Elements used in an SQL Command

Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access of Admin Panel and manage every account of Result...

PT-2021-11744

Name of the Vulnerable Software and Affected Versions: Employee Performance Evaluation System in PHP/MySQLi with Source Code version 1.0 Description: The issue concerns cross-site scripting XSS in the Admin Portal, specifically in the Task and Description fields. This allows for potential malicio...

Beers with Talos Ep. #99: P@ssw0rds and closing out 2020

Beers with Talos BWT Podcast episode No. 99 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. By Mitch Neff. Recorded late November 2020. We recorded this episode toward...

PT-2021-27575

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves functions such as pdf load version, pdf init document, and p...

CVE-2021-23927

OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...

PT-2021-28041

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details about the crash include the function names ZSTD createDDict advanced, ZSTD...

Threat Source newsletter (Jan. 7, 2021)

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers and welcome to the first Threat Source newsletter of 2021. We hit the ground running already this year with a new Beers with Talos episode. It was recorded back in 2020, but the lessons regarding ransomware attacks and how actors...

PT-2021-28234

Name of the Vulnerable Software and Affected Versions: blosc affected versions not specified Description: The issue is related to a crash caused by an unknown read. Technical details about the crash include the function names blosc d, do job, and blosc run decompression with context...

CVE-2020-29228: Improper Neutralization of Special Elements used in an SQL Command

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page...

PT-2020-17114

Name of the Vulnerable Software and Affected Versions EGavilanMedia User Registration and Login System With Admin Panel version 1.0 Description The issue is related to cross-site scripting XSS in the Admin Profile Page. This allows an attacker to inject an XSS payload in the Admin Full Name field...

CVE-2020-29230: Improper Neutralization of Input During Web Page Generation

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting XSS in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each tim...

CVE-2020-29231: Improper Neutralization of Input During Web Page Generation

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting XSS in the Admin Profile Page. This vulnerability can result in the attacker injecting the XSS payload in Admin Full Name and each time admin visits the Profile page from the admin panel, the...