CVE-2020-9405

CVE-2020-9405 affects IBL Online Weather prior to 4.3.5a. The vulnerability is an unauthenticated reflected XSS via the redirect page, stemming from insufficient input validation on client-side data; exploitation would enable running client-side scripts in the context of the affected site. No exp...

WordPress ultimate-weather cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Give is a fundraising platform plugin used in it. ghost is a plugin used in it for importing/exporting WordPress data. A cross-site...

CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

EUVD-2014-4488

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-4561

CVE-2014-4561 affects the WordPress Ultimate Weather Plugin (

Top Play Store Weather app steals user data & sends to Chinese server

By Sudais The weather app called Weather Forecast: World Weather Accurate Radar on two of Alcatel's Android smartphone models, namely the Pixi 4 and A3 Max. This is a post from HackRead.com Read the original post: Top Play Store Weather app steals user data & sends to Chinese server...

Real-life social engineering. Two days in tweets

This is the write-up of my live tweets while on a recent social engineering engagement. It’s all available on my feed @ghostie I did this because I wanted to share what it's like to prep for, and work through a job, warts and all. If you can take anything away, to enhance your technique, or defen...

Friday Squid Blogging: Why Mexican Jumbo Squid Populations Have Declined

A group of scientists conclude that it's shifting weather patterns and ocean conditions. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

The vulnerability of the fly-weather software package for the Astra Linux operating system, related to a validation error in the input data received from web servers, allows attackers to trigger a service failure.

The vulnerability of the fly-weather software package for the Astra Linux operating system is related to a validation error in the input data received from the web server. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

The vulnerability of the fly-weather software package for the Astra Linux operating system, related to a validation error in the input data received from web servers, allows attackers to perform spoofing attacks.

The vulnerability of the fly-weather software package for the Astra Linux operating system is related to a validation error in the input data received from web servers. Exploiting this vulnerability can allow attackers to perform spoofing attacks...

CVE-2018-18875

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting XSS vulnerability allows remote authenticated users to inject arbitrary web script via changestationname.php...

CVE-2018-18877

In firmware version MS2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page configmain.php that allows manipulation of the device...

CVE-2018-18878

In firmware version MS2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable...

CVE-2018-18877

In firmware version MS2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page configmain.php that allows manipulation of the device...

CVE-2018-18876

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a readoutsrd.php directory traversal issue makes it possible to read any file present on the underlying operating system...

CVE-2018-18875

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting XSS vulnerability allows remote authenticated users to inject arbitrary web script via changestationname.php...

Cross site scripting

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting XSS vulnerability allows remote authenticated users to inject arbitrary web script via changestationname.php...

Input validation

In firmware version MS2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable...

Directory traversal

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a readoutsrd.php directory traversal issue makes it possible to read any file present on the underlying operating system...