17642 matches found
XSS Vulnerability in Learning Express Cloud Drive
Founded in 1993, Beijing Century Super Star Information Technology Development Limited Liability Company is one of the early companies in China engaged in the digitization of paper materials and the production of electronic publications. An XSS vulnerability exists in Study Pass Cloud Drive, whic...
CVE-2021-34866
creationtimestamp| type| source ---|---|--- 2021-11-06 01:51:01+00:00| seen| https://t.me/linkersec/125 2021-11-14 12:11:05+00:00| published-proof-of-concept| https://t.me/cKure/8034 2021-11-27 07:10:54+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4672 2022-01-25...
CVE-2021-42699
CVE-2021-42699 affects DAQFactory, where cookie information can be transmitted in cleartext over HTTP. This enables an attacker who can capture network traffic to obtain a user’s cookie and potentially hijack the session. Connected sources indicate affected product is DAQFactory (all versions up ...
Design/Logic Flaw
A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without priviledge...
CVE-2021-25502
CVE-2021-25502 relates to Samsung SMR (System Management Release) before the Nov-2021 Release 1, where sensitive data was stored insecurely in Property Settings, allowing a local attacker to read the ESN value without privileges. Affected product scope is Samsung SMR updates for Android/mobile de...
US offers $10m reward for decisive info on DarkSide ransomware gang
By Waqas The US is offering $10 million to anyone who can provide information to law enforcement authorities on the infamous DarkSide ransomware gang that may help in locating and arresting its operators. This is a post from HackRead.com Read the original post: US offers $10m reward for decisive...
Opencart 3 Extension TMD Vendor System - Blind SQL Injection Exploit
Exploit Title: Opencart 3 Extension TMD Vendor System - Blind SQL Injection Author: Muhammad Zaki Sulistya email protected Product: TMD Vendor System Vendor Homepage: https://www.opencartextensions.in/ Software Link: https://www.opencartextensions.in/opencart-multi-vendor-multi-seller-marketplace...
CVE-2021-33210
CVE-2021-33210 affects Fimer Aurora Vision prior to 2.97.10. The flaw allows an unauthenticated user in the WebUI to read API responses from a plant kiosk view, effectively exposing plant information without authorization. The issue is described across multiple sources (including NVD/Red Hat refe...
CVE-2021-42697
creationtimestamp| type| source ---|---|--- 2021-11-03 01:23:11+00:00| seen| https://t.me/cibsecurity/31672...
OpenAM 13.0 - LDAP Injection Exploit
Exploit Title: OpenAM 13.0 - LDAP Injection Exploit Author: Charlton Trezevant, GuidePoint Security Vendor Homepage: https://www.forgerock.com/ Software Link: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0,...
CVE-2018-6125
CVE-2018-6125 refers to an overly permissive policy in WebUSB within Chromium/Google Chrome on Windows, enabling a remote attacker to potentially access sensitive information via a crafted HTML page. The connected sources corroborate the issue as part of Chromium/Chrome updates and enumerate a fi...
CVE-2021-33611
creationtimestamp| type| source ---|---|--- 2021-11-02 13:23:24+00:00| seen| https://t.me/cibsecurity/31588...
CVE-2021-33611
CVE-2021-33611 concerns a reflected cross-site scripting vulnerability in the Vaadin menu-bar webjar resources. The issue arises from missing output sanitization in test sources within the package org.webjars.bowergithub.vaadin:vaadin-menu-bar for versions 1.0.0 through 1.2.0 (Vaadin 14.0.0–14.4....
CVE-2021-25875
creationtimestamp| type| source ---|---|--- 2021-11-01 15:21:25+00:00| seen| https://t.me/cibsecurity/31546...
CVE-2021-39179
CVE-2021-39179 concerns DHIS2 Tracker API SQL injection affecting authenticated users. Provided documents (NVD, Red Hat RH, OSV, CVE lists) describe a SQL injection in the Tracker component that can be triggered via POST paths /api/trackedEntityInstances and /api/trackedEntityInstances/query, imp...
Zales.com Leaked Customer Data, Just Like Sister Firms Jared, Kay Jewelers Did in 2018
In December 2018, bling vendor Signet Jewelers fixed a weakness in their Kay Jewelers and Jared websites that exposed the order information for all of their online customers. This week, Signet subsidiary Zales.com updated its website to remediate a nearly identical customer data exposure. Last...
CVE-2021-22468
CVE-2021-22468 affects a HarmonyOS component exhibiting an information-disclosure vulnerability that can allow a local attacker to induce kernel address leakage. The issue, described as exposing sensitive information to an unauthorized actor, is associated with HarmonyOS and has been documented i...
CVE-2021-22205
creationtimestamp| type| source ---|---|--- 2021-10-28 05:18:25+00:00| exploited| https://t.me/cKure/7805 2021-10-28 06:33:48+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/759 2021-10-28 09:55:15+00:00| published-proof-of-concept| https://t.me/hackertrick/354 2021-10-28...
CVE-2021-38379
CVE-2021-38379 affects CFEngine Enterprise Hub: versions 3.6.7–3.18.0 have insecure permissions that permit local information disclosure. Root cause is insecure hub permissions. Affected product is CFEngine Enterprise; impact is partial confidentiality breach with local access. Public exploits ar...