PT-2022-22336 · Jenkins · Jenkins Build-Metrics Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins build-metrics Plugin versions 1.3 and earlier Description: The issue concerns the Jenkins build-metrics Plugin, which does not perform permission checks in multiple HTTP endpoints. This allows attackers with Overall/Read permission to...

Ansible password prompts could expose passwords

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them...

CVE-2022-30949

Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents...

CVE-2021-44586

An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive information...

in khodakhah/nodcms

Description Clear Text submission of password through unencrypted channel Proof of Concept POST /en/login HTTP/1.1 Host: demo.nodcms.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:92.0 Gecko/20100101 Firefox/92.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language:...

Boomerang - A Tool To Expose Multiple Internal Servers To Web/Cloud

Boomerang is a tool to expose multiple internal servers to web/cloud using HTTP+TCP Tunneling. The Server will expose 2 ports on the Cloud. One will be where tools like proxychains can connect over socks, another will be for the agent to connect. The agent can be executed on any internal host. Th...

GO SMS Pro app still exposing millions of users’ sensitve data

By Sudais Asif Previously, it was revealed that the GO SMS Pro messaging app was exposing highly sensitive data of more than 100 million users. This is a post from HackRead.com Read the original post: GO SMS Pro app still exposing millions of users sensitve data...

Leonidas - Automated Attack Simulation In The Cloud, Complete With Detection Use Cases

Leonidas is a framework for executing attacker actions in the cloud. It provides a YAML-based format for defining cloud attacker tactics, techniques and procedures TTPs and their associated detection properties. These definitions can then be compiled into: A web API exposing each test case as an...

The vulnerability of the Magento Commerce software platform for developing and managing online stores lies in the lack of measures to protect SQL query structures. This allows attackers to execute arbitrary SQL queries against the database in the target system and gain access to protected information.

The vulnerability of the Magento Commerce development and management software platform lies in the lack of measures to protect SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries against the database in the target system by sending a...

DRUPAL-CORE-2020-008

The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass...

Horgos Honglu Huayu Culture Communication Co., Ltd. free book chasing APP has a logic flaw vulnerability

Free Book Chase app is a website-wide free novel reading software. Horgos Honglu Huayu Culture Communication Co. Free Book Chase App has a logic flaw vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2020-4565

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow an attacker to obtain sensitive information due to insecure communications being used between the application and server. IBM X-Force ID: 183935...

Extreme cms suffers from SQL injection vulnerability (CNVD-2020-43486)

Extreme CMS is an open source and free PHPCMS web content management system. Extreme CMS has a SQL injection vulnerability that can be exploited by attackers to obtain database information...

Harbin Qixun Technology Co., Ltd. construction system in ****.php page SQL injection vulnerability

Harbin Qixun Technology Co., Ltd. is an Internet enterprise specializing in small and medium-sized enterprise network marketing outsourcing. Harbin Qixun Technology Co., Ltd. construction system in .php page there is a SQL injection vulnerability. Attackers can use the vulnerability to obtain...

Composer composer.lock / composer.json Accessible

The remote host is exposing a SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.108761";...

CVE-2020-10085

GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles...

This Smartwatch is exposing real-time location data of thousands of kids

By Sudais The manufacturer of this Smartwatch has been informed yet they have not taken any steps to stop the data from pubic exposure. This is a post from HackRead.com Read the original post: This Smartwatch is exposing real-time location data of thousands of kids...

S-CMS php version enterprise website builder system v3.0 SQL injection vulnerability in background aj***2 parameter

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. S-CMS php version of the enterprise website building system v3.0 background aj2 parameters exist SQL injection vulnerability,...

Shenzhen ShuoWin Interactive Information Technology Co., Ltd. website building system has unauthorized access vulnerabilities

Shenzhen Shuowin Interactive Information Technology Co., Ltd. is an Internet technology development, product design, economic and trade consulting and other projects. Shenzhen Shuowin Interactive Information Technology Co., Ltd. website building system has an overstepping vulnerability, attackers...

Sql injection

Deepwoods Software WebLibrarian 3.5.2 and earlier is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" defined at databasecode.php line 1018 is vulnerable to a boolean-based blind sql injection. This function call can be triggered by...