PT-2020-20639 · Ibl · Ibl Online Weather

Name of the Vulnerable Software and Affected Versions: IBL Online Weather versions prior to 4.3.5a Description: The issue allows attackers to obtain sensitive information by reading the IWEBSERVICE JSONRPC COOKIE cookie. Recommendations: For versions prior to 4.3.5a, update to version 4.3.5a or...

CVE-2020-9407

IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICEJSONRPCCOOKIE cookie...

CVE-2020-9405: Improper Neutralization of Input During Web Page Generation

IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page...

CVE-2020-9407: Cleartext Storage of Sensitive Information

IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICEJSONRPCCOOKIE cookie...

CVE-2020-9407

IBL Online Weather prior to version 4.3.5a contains an information-disclosure vulnerability that allows an attacker to read the IWEBSERVICE_JSONRPC_COOKIE cookie and obtain sensitive data. The issue affects the software’s web-facing components and is fixed by upgrading to version 4.3.5a or later....

CVE-2020-9405

CVE-2020-9405 affects IBL Online Weather prior to 4.3.5a. The vulnerability is an unauthenticated reflected XSS via the redirect page, stemming from insufficient input validation on client-side data; exploitation would enable running client-side scripts in the context of the affected site. No exp...

CVE-2020-9406

IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service...

CVE-2020-9406

IBL Online Weather before 4.3.5a is affected by an unauthenticated eval injection via the Auxiliary Service’s queryBCP method. The vulnerability affects versions prior to 4.3.5a and stems from the queryBCP component allowing injection of code without authentication, enabling potential remote code...

CVE-2020-9406: Improper Control of Generation of Code

IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service...

PT-2020-20638 · Ibl · Ibl Online Weather

Name of the Vulnerable Software and Affected Versions: IBL Online Weather versions prior to 4.3.5a Description: The issue allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service. This enables an attacker to inject malicious code without authentication...

CVE-2020-9405

IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page...

WordPress ultimate-weather cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Give is a fundraising platform plugin used in it. ghost is a plugin used in it for importing/exporting WordPress data. A cross-site...

CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-4561

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-4561

CVE-2014-4561 affects the WordPress Ultimate Weather Plugin (

EUVD-2014-4488

The ultimate-weather plugin 1.0 for WordPress has XSS...

CVE-2014-4561: Improper Neutralization of Input During Web Page Generation

The ultimate-weather plugin 1.0 for WordPress has XSS...

PT-2020-7677

Name of the Vulnerable Software and Affected Versions ultimate-weather plugin version 1.0 Description The issue affects the ultimate-weather plugin for WordPress, allowing for cross-site scripting XSS attacks. Recommendations For version 1.0, update to a newer version that contains a fix for this...

Top Play Store Weather app steals user data & sends to Chinese server

By Sudais The weather app called Weather Forecast: World Weather Accurate Radar on two of Alcatel's Android smartphone models, namely the Pixi 4 and A3 Max. This is a post from HackRead.com Read the original post: Top Play Store Weather app steals user data & sends to Chinese server...

Real-life social engineering. Two days in tweets

This is the write-up of my live tweets while on a recent social engineering engagement. It’s all available on my feed @ghostie I did this because I wanted to share what it's like to prep for, and work through a job, warts and all. If you can take anything away, to enhance your technique, or defen...