Cross-site Scripting (XSS) - Stored in zmister2016/mrdoc

✍️ Description Stored xss bug allow to execute arbitary javascript code in vicitm account 🕵️‍♂️ Proof of Concept 1. First create a document and put bellow xss payload inside document content .\ xss"''\ 2. Now any user view this document project then xss is executed VIDEO POC --...

CVE-2021-40142

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

Design/Logic Flaw

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

CVE-2021-40142

In the OPC Foundation Local Discovery Server (LDS), versions before 1.04.402.463 are vulnerable to a DoS caused by crafted messages that trigger an access to memory location after the end of a buffer (CVE-2021-40142). The issue affects LDS and related Siemens products listed in ICS/CISA advisorie...

CVE-2021-40142

In OPC Foundation Local Discovery Server LDS before 1.04.402.463, remote attackers can cause a denial of service DoS by sending carefully crafted messages that lead to Access of a Memory Location After the End of a Buffer...

Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload

The plugin does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE As admin, upload a PHP file via the Add Logo page of the plugin...

Adobe Bridge 11.x < 11.1.1 Multiple Vulnerabilities (APSB21-69)

The version of Adobe Bridge installed on the remote Windows host is prior to 11.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb21-69 advisory. - Adobe Bridge version 11.1 and earlier is affected by a memory corruption vulnerability due to insecure handling of...

Exploit for Cross-site Scripting in Tastyigniter

CVE-2021-38699 : Multiple Reflected XSS in TastyIgniter v3.0.7...

A Simple Software Fix Could Limit Location Data Sharing

Carriers know where you are every time your phone reconnects to the cell network—but with Pretty Good Phone Privacy, they wouldn’t have to...

olingo-odata: Server side request forgery in AsyncResponseWrapperImpl

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can...

Improper Input Validation in Centreon Web

Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings...

De-anonymization Story

This is important: Monsignor Jeffrey Burrill was general secretary of the US Conference of Catholic Bishops USCCB, effectively the highest-ranking priest in the US who is not a bishop, before records of Grindr usage obtained from data brokers was correlated with his apartment, place of work,...

Commercial Location Data Used to Out Priest

A Catholic priest was outed through commercially available surveillance data. Vice has a good analysis: The news starkly demonstrates not only the inherent power of location data, but how the chance to wield that power has trickled down from corporations and intelligence agencies to essentially a...

Adobe Illustrator < 25.3.0 Multiple Vulnerabilities (APSB21-42)

The version of Adobe Illustrator installed on the remote Windows host is prior to 25.3.0. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-42 advisory. - Adobe Illustrator version 25.2.3 and earlier is affected by a potential Command injection vulnerability when...

CVE-2021-0518

In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-176541...

CVE-2021-0590

In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissions due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User...

CVE-2021-0518

In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-176541...

CVE-2021-0518

In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-176541...

Information disclosure

In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-176541...

CVE-2021-0518

CVE-2021-0518 affects Android 13, where a missing permission check in Wi‑Fi can leak location‑sensitive data, enabling local information disclosure without extra execution privileges. Root cause: lack of access control around Wi‑Fi data exposure. Impact is information disclosure with no user inte...