Input validation

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

CVE-2019-15619

CVE-2019-15619 affects Nextcloud Suite components: Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3, and Nextcloud Deck 0.6.5. The root cause is improper neutralization of file names, conversation names and board names, leading to cross-site scripting when linking these items within a project. Docum...

CVE-2019-15619: Improper Neutralization of Input During Web Page Generation

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

openSUSE Security Update : LibreOffice (openSUSE-2019-1929)

This update for libreoffice and libraries fixes the following issues : LibreOffice was updated to 6.2.5.2 fate327121 bsc1128845 bsc1123455, bringing lots of bug and stability fixes. Additional bugfixes : - If there is no firebird engine we still need java to run hsqldb bsc1135189 - PPTX: Rectangl...

Improper neutralization of item names in projects feature (NC-SA-2020-009)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Improper neutralization of item names in projects feature (NC-SA-2020-008)

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

Uber: [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools

A configuration file on experience.uber.com exposed details for the server configuration as well as information about the content hosted on the site. The site itself did require authentication to log in, but this config file was publicly accessible. Other accessible URLs included slide deck...

Duckie Deck SandwichChef Lite - Base64 encoded String, Native code usage, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Duckie Deck SandwichChef Lite published at the 'play' market has multiple vulnerabilities...

Duckie Deck Monsters - BSD license, GPL license, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Duckie Deck Monsters published at the 'play' market has multiple vulnerabilities...

Duckie Deck Baby Tunes - BSD license, Base64 encoded String, GPL license vulnerabilities

HackApp vulnerability scanner discovered that application Duckie Deck Baby Tunes published at the 'play' market has multiple vulnerabilities...

Deck Heroes: Duel des Ténèbres - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Deck Heroes: Duel des Ténèbres published at the 'play' market has multiple vulnerabilities...

Deck Heroes: Legacy - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Deck Heroes: Legacy published at the 'play' market has multiple vulnerabilities...

Tech Deck Skateboarding - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Tech Deck Skateboarding published at the 'play' market has multiple vulnerabilities...

Magic: Deck Builder - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Magic: Deck Builder published at the 'play' market has multiple vulnerabilities...

X (Formerly Twitter): Tweet Deck XSS- Persistent- Group DM name

Hello Group names in tweetdeck.twitter.com aren't filtered properly, giving scope for Cross site vulnerability attacks. Challenge I have faced while escalating the xss: - group name can only be 9 character long. How i bypassed it: Set multiple group names with different payloads, which means we c...

daiquirideck.com XSS vulnerability

Vulnerable URL: http://www.daiquirideck.com/madeira/? Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 17:34 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7020942 Google Pagerank| 3 VIP website status:| No...

Hardcoded credentials

The Pilot Below Deck Equipment BDE and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface...

CVE-2014-0326

The Pilot Below Deck Equipment BDE and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface...

CVE-2014-0327: Undefined Security Weakness

The Terminal Upgrade Tool in the Pilot Below Deck Equipment BDE and OpenPort implementations on Iridium satellite terminals allows remote attackers to execute arbitrary code by uploading new firmware to TCP port 54321...

CVE-2014-0326: Undefined Security Weakness

The Pilot Below Deck Equipment BDE and OpenPort implementations on Iridium satellite terminals allow remote attackers to read hardcoded credentials via the web interface...