PT-2023-16510 · WordPress · Clock In Portal- Staff & Attendance Management

Name of the Vulnerable Software and Affected Versions: The Clock In Portal- Staff & Attendance Management WordPress plugin versions 2.1 and earlier Description: The issue is related to the lack of a CSRF check when deleting designations, which could allow attackers to make logged-in admins delete...

Clock In Portal <= 2.1 - Designation Deletion via CSRF

The plugin does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack Make a logged in admin open a page with the code below, this will make them delete the Designation with ID 2...

Clock In Portal <= 2.1 - Designation Deletion via CSRF

The plugin does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack PoC Make a logged in admin open a page with the code below, this will make them delete the Designation with ID 2...

PT-2023-17691 · Unknown · Sourcecodester Employee/Visitor Gate Pass Logging System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 Description: A critical issue has been discovered, affecting an unknown function of the file /admin/maintenance/view designation.php, specifically the component GET...

SourceCodester Employee and Visitor Gate Pass Logging System SQL注入漏洞

Employee and Visitor Gate Pass Logging System is an employee and visitor pass logging system by Carlo Montero, an individual developer. SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 suffers from a SQL injection vulnerability that stems from a problem in the file...

Demanzo Matrimony 1.5 Cross Site Request Forgery

==================================================================================================================================== | Title : Demanzo Matrimony v.1.5 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 109.0.132-bit | |...

CVE-2022-40927

Online Leave Management System v1.0 is vulnerable to SQL Injection via /leavesystem/classes/Master.php?f=deletedesignation...

PT-2022-25625 · Unknown · Online Leave Management System

Name of the Vulnerable Software and Affected Versions: Online Leave Management System version 1.0 Description: The issue concerns a SQL Injection vulnerability via the "/leave system/classes/Master.php?f=delete designation" API endpoint. This allows for potential unauthorized access and...

CVE-2022-29979

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=deletedesignation...

CVE-2022-29979

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Master.php?f=deletedesignation...

Simple Client Management System SQL注入漏洞

Simple Client Management System is a simple client management system from Carlo Montero's personal developer. version 1.0 of Simple Client Management System is vulnerable to SQL injection, which originates from a vulnerability in /cms/classes/Master. php?f=deletedesignation, the id parameter of t...

Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021

Over the past year, the Microsoft Threat Intelligence Center MSTIC has observed a gradual evolution of the tools, techniques, and procedures employed by malicious network operators based in Iran. At CyberWarCon 2021, MSTIC analysts presented their analysis of these trends in Iranian nation state...

VMware Carbon Black Cloud™ Awarded Cyber Catalyst Designation

VMware Carbon Black Cloud has been awarded a Cyber CatalystSM designation for its cloud native endpoint and workload protection platforms, which helps more than 20,000 organizations worldwide detect and stop emerging attacks. The designation is part of the annual Cyber Catalyst by Marsh℠ program,...

Lavalite Cross-Site Scripting Vulnerability (CNVD-2020-41526)

Lavalite is an open source PHP-based content management system CMS. A cross-site scripting vulnerability exists in Lavalite version 5.7, which can be exploited to conduct cross-site scripting attacks via the admin/profile name or designation fields...

Singapore government gets into the network defense game

There is a common assumption in the infosec community that enormous breaches like those at Equifax, Anthem, and Target are the new norm. That the next mega breach is simply a matter of time. This is because large companies loathe spending money on things that are not directly profitable like secu...

Distributed Red Team Operations with Cobalt Strike

What if you could easily host malicious websites, send phishing emails, and manage compromised hosts across diverse internet addresses? This week's Cobalt Strike adds the ability to manage multiple attack servers at once. Here's how it works: When you connect to two or more servers, Cobalt Strike...

jar: scheme ignores the content-disposition: header on the inner URI

The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of the inner URI, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly other attacks via an uploaded .jar file with a...

Memory corruption

Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file involving the "denoting of the start of a Workspace designation", which results in memory corruption, aka the "Workbook Memory Corruption...

CVE-2007-3030

Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execute arbitrary code via a malformed Excel file involving the "denoting of the start of a Workspace designation", which results in memory corruption, aka the "Workbook Memory Corruption...

CVE-2003-0077

The hanterm hanterm-xf terminal emulator 2.0.5 and earlier, and possibly later versions, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious...