The vulnerability of the User Monitoring component in the Application Management Pack of the Oracle E-Business Suite allows a malicious individual to gain unauthorized access to protected data.

The vulnerability of the User Monitoring component in the Application Management Pack of the Oracle E-Business Suite is related to access control errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected data using the HTTP...

HackerOne: Confidential data of users and limited metadata of programs and reports accessible via GraphQL

Summary: The GraphQL endpoint doesn't have access controls implemented properly. Description: Any attacker can get personally identifiable information of users of Hackerone such as email address, backup hash codes, facebookuserid, accountrecoveryphonenumberverifiedat, totpenabled, etc. These are...

The vulnerability of the Xenvironment component in the Oracle Retail Xstore Point of Service software allows a perpetrator to gain full control over the application.

The vulnerability of the Xenvironment component in the Oracle Retail Xstore Point of Service software is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTP protocol...

The vulnerability of the sub-component “Attachments/File Upload” of the Oracle Application Object Library in the Oracle E-Business Suite system allows a perpetrator to access, modify, add, or delete data.

The vulnerability of the Attachments/File Upload sub-component of the Oracle Application Object Library in the Oracle E-Business Suite system related to access control deficiencies. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete...

WIBU-SYSTEMS WibuKey.sys 0x8200E804 kernel memory information disclosure vulnerability

Summary An exploitable kernel memory disclosure vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys Version 6.40 Build 2400. A specially crafted IRP request can cause the driver to return uninitialized memory, resulting in kernel memory disclosure. An...

Cisco Firepower Threat Defense Software Denial of Service Vulnerability (CNVD-2020-12741)

Cisco Firepower Threat Defense FTD Software is a suite of unified software that provides next-generation firewall services from Cisco. data acquisition DAQ is one of the data acquisition components. A denial of service vulnerability exists in Cisco Firepower Threat Defense Software, which arises...

Improper access control

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

CVE-2019-1653

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

CVE-2019-1653 Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

CVE-2019-1653

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

Joomla FPSS Art Frontpage Slideshow 1.6.0 Database Disclose / SQL Injection

Exploit Title : Joomla FPSS Art Frontpage Slideshow Components 1.6.0 Database Disclosure / Open Redirection / SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 19/01/2019 Vendor Homepage : artetics.com Software Information Link :...

Joomla ZHYandexMap 8.0.0.2 Database Disclosure

Exploit Title : Joomla ZHYandexMap Components 8.0.0.2 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/01/2019 Vendor Homepage : joomla.org Software Information Link : extensions.joomla.org/extension/zh-yandexmap/ Software Download Link :...

Design/Logic Flaw

To provide fine-grained controls over the ability to use Dynamic DNS DDNS to update records in a zone, BIND 9 provides a feature called update-policy. Various rules can be configured to limit the types of updates that can be performed by a client, depending on the key used when sending the update...

DEBIAN-CVE-2018-4181

In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions...

CVE-2018-16197

Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass access restriction to access the information and files stored on the affected device...

Joomla Codextrous B2jcontact 2.1.17 Shell Upload

Exploit Title : Joomla Codextrous ComB2jcontact Components 2.1.17 Shell Upload Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 04/01/2019 Vendor Homepage : codextrous.com/joomla-components/b2j-contact.html + extensions.joomla.org/extension/b2j-contact/ Software...

Typo3 CMS pw_highslide_gallery 0.3.1 Database Disclosure

Exploit Title : Typo3 CMS pwhighslidegallery Extension 0.3.1 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org Software Download Link : extensions.typo3.org/extension/download/pwhighslidegallery/0.3.1/zip/...

Typo3 CMS twwc_pages 8.7.x Database Disclosure

Exploit Title : Typo3 CMS twwcpages Extension 8.7.x Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 02/01/2019 Vendor Homepage : typo3.org Software Download Link : gosign.de/typo3-extension/twwcpages/ Tested On : Windows and Linux Category :...

SUSE SLES12 Security Update : php7 (SUSE-SU-2018:1176-1)

This update for php7 fixes the following issues: Security issues fixed : - CVE-2018-10545: Fix access controls in FPM child processes bsc1091367. - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages bsc1091362. - CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c...

PrestaShop yllyaidechantier 1.4.9.0 Database Disclosure

Exploit Title : PrestaShop yllyaidechantier Modules 1.4.9.0 Database Disclosure Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 24/12/2018 Vendor Homepage : prestashop.com Software Download Link : N/A Tested On : Windows and Linux Category : WebApps Version...