PT-2021-23259 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.13.12 Description: The issue allows anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References IDOR vulnerability in the...

CVE-2021-41305

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References IDOR vulnerability in the Average Number of Times in Status Gadget. The affected versions are before version...

CVE-2021-41304

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from...

CVE-2021-39127

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken Access Control vulnerability BAC vulnerability. The affected versions are before version 8.5.10, and from version 8.6.0 before 8.13.1...

PT-2021-22391 · Atlassian · Jira +1

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.5.10 Atlassian Jira Server and Data Center versions 8.6.0 through 8.13.1 Description: The issue allows anonymous remote attackers to access the query component JQL endpoint via a Broke...

CVE-2021-43409

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

UBUNTU-CVE-2021-39882

In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user...

CVE-2021-39882

In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user...

CVE-2021-39882

In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user...

PT-2021-22728 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE affected versions not specified Description: The issue allows anonymous users to retrieve information about any GitLab user, given a user ID, by utilizing certain endpoints. Recommendations: At the moment, there is no information...

CVE-2021-39882: Cleartext Transmission of Sensitive Information

In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS has a security vulnerability. An attacker can exploit the vulnerability to make anonymous calls to Unicom...

Anonymous leaks more EPIK host data; ‘larger than previous leak’

By Waqas According to Anonymous, the EPIK data leak involves bootable disk images, API tokens, over 500,000 private keys, etc. all in plain-text format. This is a post from HackRead.com Read the original post: Anonymous leaks more EPIK host data; larger than previous leak...

GitLab 信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

Improper access control

Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. In addition, such users can be granted several admin permissions via the Roles parameter...

CVE-2021-41325

Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile parameter. In addition, such users can be granted several admin permissions via the Roles parameter...

CVE-2021-41325

CVE-2021-41325 affects Pydio Cells 2.2.9. It has broken access control allowing remote anonymous users to create standard accounts via the profile parameter, and can grant admin permissions via the Roles parameter. This enables unauthorized account creation and potential privilege elevation. Reme...

Abstrium Pydio Cells 安全漏洞

Abstrium Pydio Cells is a next-generation file-sharing platform developed in the Go language by French company Abstrium. A security vulnerability exists in Pydio Cells 2.2.9 that allows remote anonymous users to create standard users via the profile parameter...

AutomatorWP < 1.7.6 - Missing Authorization and Privilege Escalation

The plugin does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions. Attack Procedures 1 Run this in Dashboard while logged in as Subscribe...

Far-right host Epik confirms its data was breached by Anonymous

By Waqas The domain registrar Epik has confirmed that its systems were hacked by a group affiliated with the Anonymous hacktivist collective. This is a post from HackRead.com Read the original post: Far-right host Epik confirms its data was breached by Anonymous...