QIWI: account takeover https://teamplay.qiwi.com

Здравствуйте. Нашел баг, как украсть аккаунт на данном сайте. Для того, чтобы это провернуть нам нужно знать эмайл вашего пользователя. Предположим что пользователь зашел на ваш сайт через аккаунт ВКонтакте, к его странице привязана почта [email protected] Мы идем на https://www.faceit.com и...

Intelbras NPLUG License Issue Vulnerability

Intelbras NPLUG is a wireless relay device from Intelbras Poland. Intelbras NPLUG is vulnerable to an authorization issue. An attacker could exploit this vulnerability to bypass authentication...

Micronet INplc-RT Authorization Issue Vulnerability (CNVD-2019-40825)

Micronet INplc-RT is a software-defined PLC Programmable Logic Controller from Micronet Japan. An authorization issue vulnerability exists in Micronet INplc-RT version 3.08 and earlier. A remote attacker could exploit this vulnerability to execute arbitrary commands...

ABB eSOMS Authorization Issues Vulnerabilities

ABB eSOMS is a plant operations management system from ABB Switzerland. An authorization issue vulnerability exists in ABB eSOMS version 6.0.2. An attacker could exploit this vulnerability to gain unauthorized access to the system...

Nextcloud Server Authorization Issues Vulnerability

Nextcloud is a client-server software suite for creating network hard disks. An authorization issue vulnerability exists in versions of Nextcloud Server prior to 12.0.3, which can be exploited by an attacker to obtain user credentials and bypass two-factor authentication...

PT-2018-16196 · Mosquitto · Aedes

Name of the Vulnerable Software and Affected Versions: aedes versions prior to 0.35.1 Description: The issue is related to improper authorization, where aedes does not respect its own authorization rules when a client sets a Last Will. This can lead to publishing a Last Will and Testament LWT in ...

Apple iCloud Security Updates (HT208853)

Apple iCloud is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:icloud"; ifdescription...

Apple iTunes Security Updates (HT208852)

Apple iTunes is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:itunes"; ifdescription...

Apple Mac OS X Security Updates (HT208849)-01

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

About the security content of iCloud for Windows 7.5

About the security content of iCloud for Windows 7.5 This document describes the security content of iCloud for Windows 7.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

About the security content of iTunes 12.7.5 for Windows

About the security content of iTunes 12.7.5 for Windows This document describes the security content of iTunes 12.7.5 for Windows. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patche...

Design/Logic Flaw

Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization for by way of the 'reportName' parameter...

Vimeo: Improper Authentication in Vimeo's API 'versions' endpoint.

The versions endpoint was exploitable by accounts that were not pro or business. Issue -- There was an authorization issue in versions endpoint, Which on exploiting could allow an attacker to leak private videos of pro/business users due to the fact version is only applicable for pro/business...

CVE-2017-0927

Removed by vendor...

Code injection

IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or modify arbitrary reports by leveraging an incorrect grant of access. IBM X-Force ID: 111783...

Authorization

In SAP Solution Manager 7.20, the role SAPBPOCONFIG gives the Business Process Operations BPO configuration user more authorization than required for configuring the BPO tools...

CVE-2017-17693

Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback...

CVE-2017-1628

IBM Business Process Manager 8.6.0.0 allows authenticated users to stop and resume the Event Manager by calling a REST API with incorrect authorization checks...

Huawei FusionSphere OpenStack Licensing Issue Vulnerability

Huawei FusionSphere OpenStack is a suite of FusionSphere cloud operating system cloud platform software for ICT scenarios from Huawei, China. An authorization issue vulnerability exists in Huawei FusionSphere OpenStack version V100R006C00, which stems from an unreasonable privilege configuration...

CVE-2017-14007

CVE-2017-14007 affects the ProMinent MultiFLEX M10a Controller web interface. The issue is Insufficient Session Expiration: a user’s session remains usable beyond the last activity, allowing an attacker to reuse an old session for authorization. Public sources (NVD) document the vulnerability wit...