PT-2021-15879

Name of the Vulnerable Software and Affected Versions iFlyChat WordPress plugin versions prior to 4.7.0 Description The issue is related to an authenticated Stored Cross-Site Scripting problem. It occurs because the APP ID setting is not properly sanitized before being outputted back in the page...

Updates to Snort setup guides

Our documentation on Snort 3 running on CentOS and the Snort Rules Writing guide to Snort 3. Thanks to community member Yaser for providing the updates. The Snort 3 guide now has expanded information on logging options — such as syslog and JSON. There is also a new performance optimization sectio...

CVE-2019-2089

In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10 Android...

PT-2020-10854

Name of the Vulnerable Software and Affected Versions Android versions Android-10 Description In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege with no additional execution privileges...

CVE-2019-2089: Incorrect Permission Assignment for Critical Resource

In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10 Android...

Lark Technologies: Stealing app credentials by reflected xss on Lark Suite

A reflected cross-site scripting XSS vulnerability was found on a Lark Suite endpoint via the 'next' parameter which an attacker could have potentially used to obtain app credentials must first know the app ID. We have resolved this issue and thank @imrannisar for reporting this to our team...

CVE-2019-0054: Improper Certificate Validation

An Improper Certificate Validation weakness in the SRX Series Application Identification app-id signature update client of Juniper Networks Junos OS allows an attacker to perform Man-in-the-Middle MitM attacks which may compromise the integrity and confidentiality of the device. This issue affect...

PT-2019-3479

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 15.1X49-D120 on SRX Series devices. Description The issue is related to an Improper Certificate Validation weakness in the SRX Series Application Identification app-id signature update client, allowi...

CVE-2018-11935

Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in...

CVE-2018-11935

Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in...

Input validation

Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in...

CVE-2018-11935: Improper Input Validation

Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in...

PT-2019-8828

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions MDM9607, MDM9650, MDM9655, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660,...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

Z-BlogPHP Arbitrary PHP Code Execution Vulnerability

Z-BlogPHP is an open source PHP-based blog system developed by the Z-Blog community. plugin upload component is one of the plugin upload components. A security vulnerability exists in the plugin upload component in Z-BlogPHP version 1.5.1. A remote attacker can exploit this vulnerability by sendi...

Z-BlogPHP Cross-Site Scripting Vulnerability (CNVD-2018-08697)

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site scripting vulnerability exists in Z-BlogPHP version 1.5.1. A remote attacker can exploit this vulnerability by sending the 'appid' parameter to the zbusers/plugin/AppCentre/pluginedit.php file to...

PT-2018-18890

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.1 Description The issue allows remote attackers to execute arbitrary PHP code via the app id parameter to "zb users/plugin/AppCentre/plugin edit.php" due to an unanchored regular expression. This can be exploited by...

PT-2018-18902

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.1 Description The issue allows for XSS via the app id parameter in the zb users/plugin/AppCentre/plugin edit.php endpoint. This requires direct access by an administrator or can be exploited through CSRF. Recommendations...