CVE-2021-25527

Improper export of Android application components vulnerability in Samsung Pay India only prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication...

Authentication flaw

Improper export of Android application components vulnerability in Samsung Pay India only prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication...

Synel Eharmonynew Authorization Issue Vulnerability

Synel Eharmonynew is a time and attendance system from Synel Israel. Synel eharmonynew suffers from an authorization issue vulnerability that stems from the ability to log in to the system using default credentials and export eHarmony system reports containing sensitive data employee names,...

Atlassian Jira authorization issue vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage various types of issues and defects in the workplace. An authorization issue vulnerability exists in Atlassian Jira Server and Data Center, which stems from the product's...

CVE-2021-25527: Improper Export of Android Application Components

Improper export of Android application components vulnerability in Samsung Pay India only prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication...

CVE-2021-41309: Improper Authentication

Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken Authentication vulnerability in the /plugins/servlet/audit/resource endpoint. The...

PT-2021-23263 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Atlassian Jira Server and Data Center versions prior to 8.19.1 Description: The issue allows a user who has had their Jira Service Management access revoked to export audit logs of another user's Jira Service Management project via a Broken...

CVE-2021-34544

An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may allow sensitive information to be read by someone with access to the device. Fixed with 3.0.0-60 11.10.2013 for SL 200, 500, 1000 / not...

PT-2021-20539 · Unknown · Solar-Log 200 +2

Name of the Vulnerable Software and Affected Versions: Solar-Log 500 versions prior to 2.8.2 Build 52 23.04.2013 Solar-Log 200 versions prior to 3.0.0-60 11.10.2013 Solar-Log 1000 versions prior to 3.0.0-60 11.10.2013 Description: An issue was discovered in the affected software where cleartext...

CVE-2021-24931

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an SQL injection...

CVE-2021-24931

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action available to both unauthenticated and authenticated users before using it in a SQL statement, leading to an SQL injection...

CVE-2021-24915

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

CVE-2021-24915

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

PT-2021-16365

Name of the Vulnerable Software and Affected Versions: Contest Gallery WordPress plugin versions prior to 13.1.0.6 Description: The issue allows unauthenticated attackers to perform SQL injection attacks and obtain a list of all users registered on the blog, including their username and email...

CVE-2021-24915: Improper Neutralization of Special Elements used in an SQL Command

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections...

Israel Bans Sales of Hacking and Surveillance Tools to 65 Countries

Israel's Ministry of Defense has dramatically restricted the number of countries to which cybersecurity firms operating in the nation are allowed to sell offensive hacking and surveillance tools to, cutting off 65 nations from the export list. The revised list, details of which were first reporte...

November 22, 2021—KB5007253 (OS Builds 19041.1387, 19042.1387, 19043.1387, and 19044.1387) Preview

November 22, 2021—KB5007253 OS Builds 19041.1387, 19042.1387, 19043.1387, and 19044.1387 Preview Applies To Windows 10, version 2004, all editions Windows Server version 2004 Windows 10, version 20H2, all editions Windows Server, version 20H2, all editions Windows 10, version 21H1, all editions...

Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF

The plugin does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page such as...

Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF

The plugin does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page such as...

Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure

The plugin does not have any authorisation and CSRF checks in the likebtnexportvotes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog. fetch"http://example.com/wp-admin/admin-ajax.php",...