Unspecified vulnerability in cPanel (CNVD-2019-27408)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 57.9999.105. An attacker could exploit the vulnerability to...

CVE-2019-7864

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7864

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

Design/Logic Flaw

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2019-7864

CVE-2019-7864 describes an insecure direct object reference (IDOR) in Magento’s RSS feeds. Affected products are Magento 2.1 releases before 2.1.18, Magento 2.2 before 2.2.9, and Magento 2.3 before 2.3.2, where RSS feed requests could expose order details to unauthorized users. The Red Hat and OS...

CVE-2019-7864

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

CVE-2016-10856

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds SEC-29...

CVE-2016-10856

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds SEC-29...

Code injection

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds SEC-29...

CVE-2016-10856

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds SEC-29...

CVE-2016-10856

CVE-2016-10856 affects cPanel prior to 11.54.0.0, where subaccounts can disclose sensitive data through comet feeds (SEC-29). The provided connected sources confirm the affected product/version range and the data exposure vector but do not specify deeper root cause or exploit details. No explicit...

CVE-2019-0752

creationtimestamp| type| source ---|---|--- 2019-07-18 14:16:29+00:00| seen| MISP/5d307d92-3514-4a9b-9840-0a540a950b0c 2019-08-11 10:22:59+00:00| published-proof-of-concept| https://t.me/ExcreamOnSecurity/238 2019-11-08 10:03:52+00:00| seen| MISP/5dc53d64-eef8-4ee2-bb5c-4b240a3b4631 2019-11-08...

CVE-2019-0880

creationtimestamp| type| source ---|---|--- 2019-07-10 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=405 2019-07-10 15:25:57+00:00| seen| https://t.me/CyberGovIL/526 2019-07-11 04:20:57+00:00| exploited| https://t.me/CyberGovIL/528 2020-09-03 09:53:03+00:00| seen|...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

Cross site scripting

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS...

CVE-2019-12823

Craft CMS before 3.1.31 is vulnerable to cross-site scripting due to improper filtering of XML feeds. Affects Craft CMS core XML feed handling; attacker could inject and execute client-side scripts. CVSS metrics indicate MEDIUM severity (CVSS 3.1 base 6.1) with network access, no privileges requi...

UPDATE: OWASP Dependency-Check 5.0.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. About 18 hours ago, a new version was released. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP...

Slack Bug Allows Remote File Hijacking, Malware Injection

A remotely exploitable vulnerability in the Windows desktop app version of the Slack collaboration platform has been uncovered, which allows attackers to alter where files from Slack are downloaded. Nefarious types could redirect the files to their own SMB server; and, they could manipulate the...