DayByDay CRM Cross-Site Scripting Vulnerability (CNVD-2022-68549)

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. A cross-site scripting vulnerability exists in DayByDay CRM. The vulnerability stems from the title field of a new task in the product...

CVE-2022-22111

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged use...

Improper Authorization in saleor/saleor

Title GraphQL traversal due to missing permission checks Description orders and customers fields allow to access each other via nodes edges. However, connections don't check user's permissions, which allows, for instance, a staff with just Customers permissions get full information about the orde...

Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework

Description Stored cross site scripting vulnerability in pimcore app, name and description field field is vulnerable to xss in customer automation rules. Proof of Concept 1 .login to the account 2 .go to customers -- customer automation rules -- Add payload in name field. 3 .payload " Impact This...

The Log4j story, and how it has impacted our customers

Read about the Log4j story, an analysis of the impact and what to do next...

Cross-site Scripting (XSS) - Stored in polonel/trudesk

Description There are several areas in the web application that are vulnerable to stored XSS. They include: The chat feature when sending messages /messages/startconversation The name field when creating a department /departments Name field when creating teams /teams You can also exploit the XSS...

Chain Sea Ai Chatbot System 代码问题漏洞

Chain Sea Ai Chatbot System is an intelligent human customer service software from Chain Sea, a Chinese company. or execute arbitrary code to take control of the system or terminate the service...

German audio tech giant Sennheiser exposed 55GB of customers’ data

By Waqas Sennheiser left personal data of over 28,000 customers exposed on a misconfigured Amazon Web Services AWS server. This is a post from HackRead.com Read the original post: German audio tech giant Sennheiser exposed 55GB of customers data...

Update on Log4Shell’s Impact on Rapid7 Solutions and Systems

Like the rest of the security community, we have been internally responding to the critical remote code execution vulnerability in Apache’s Log4j Java library a.k.a. Log4Shell. We have been continuously monitoring for Log4Shell exploit attempts in our environment and have been urgently...

Citrix Security Advisory for CVE-2021-44228, CVE-2021-45046, CVE-2021-45105 and CVE-2021-44832.

Citrix is aware offourvulnerabilitiesaffectingApache Log4j2, threeof whichmayallowan attackertoexecute arbitrary code. Thesethreevulnerabilitieshavebeen given the followingidentifiers: CVE-2021-44228 CVE-2021-45046 CVE-2021-44832 Thefourthvulnerabilitymay allowan attackertocause a denial of...

CVE-2021-44228 - Zero Day Vulnerability in Apache Log4j that allows remote code execution (RCE)

See how Akamai helped open-source logging library Log4j fight against a critical unauthenticated remote code execution RCE vulnerability and reduce customer exposure...

Genesys Intelligent Workload Distribution SQL注入漏洞

Genesys Intelligent Workload Distribution Iwd is an application from Genesys, Inc. It can be used with the Genesys Customer Interaction Management Cim platform to assign tasks to the resources best suited to handle them. A SQL injection vulnerability exists in Genesys Intelligent Workload...

The vulnerability of the SAP Customer Relationship Management (CRM) system regarding customer relationship management, related to incorrect restrictions on the path to the restricted catalog, allows a perpetrator to execute arbitrary commands.

The vulnerability of the SAP Customer Relationship Management CRM system regarding customer relationship management is related to incorrect restrictions on the path to the restricted catalog. Exploitation of this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

Structured threat hunting: One way Microsoft Threat Experts prioritizes customer defense

Todays threat landscape is incredibly fast-paced. New campaigns surface all the time, and the amount of damage that they can cause is not always immediately apparent. Security operations centers SOCs must be equipped with the tools and insight to identify and resolve potentially high-impact threa...

ZOHO ManageEngine SupportCenter Plus server-side request forgery vulnerability

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. Used to allow organizations to effectively manage customer requests, their account and contact information, and service contracts, and in the process provide a superior customer experience, ZOHO...

Zoho ManageEngine SupportCenter Plus 代码问题漏洞

ZOHO ManageEngine SupportCenter Plus is a web-based customer support software from ZOHO, Inc. Used to allow organizations to effectively manage customer requests, their account and contact information, and service contracts, and in the process provide a superior customer experience, ZOHO...

A masterclass in responding to vulnerability disclosure: The Buddi app and tracker

The Buddi tracker is used for tracking elderly and vulnerable people. It’s a GPS/GSM-based clip-on device that reports wearer position to an app via a platform. It means that the wearer can easily be found by their carer or the emergency services, should they become lost and unable to make their...

Millions of GoDaddy customer data compromised in breach

Domain name registrar giant and hosting provider GoDaddy yesterday disclosed to the Securities and Exchange Commission SEC that it had suffered a security breach. In the notice, it explained it had been compromised via an "unauthorized third-party access to our Managed WordPress hosting...

GoDaddy Data Breach Exposes Over 1 Million WordPress Customers' Data

Web hosting giant GoDaddy on Monday disclosed a data breach that resulted in the unauthorized access of data belonging to a total of 1.2 million active and inactive customers, making it the third security incident to come to light since 2018. In a filing with the U.S. Securities and Exchange...

Iranian targeting of IT sector on the rise

Iranian threat actors are increasing attacks against IT services companies as a way to access their customers’ networks. This activity is notable because targeting third parties has the potential to exploit more sensitive organizations by taking advantage of trust and access in a supply chain...