2340 matches found
CVE-2020-15501
The CVE-2020-15501 entry applies to the Smarter Coffee Maker before the 2nd generation. The vulnerability allows firmware replacement without authentication or authorization; user interaction is required (pressing a button). The issue affects products that are no longer supported by the maintaine...
FreeBSD : libexif -- multiple vulnerabilities (cff0b2e2-0716-11eb-9e5d-08002728f74c)
Release notes : Lots of fixes exposed by fuzzers like AFL, ClusterFuzz, OSSFuzz and others : CVE-2016-6328: fixed integer overflow when parsing maker notes CVE-2017-7544: fixed buffer overread CVE-2018-20030: Fix for recursion DoS CVE-2019-9278: replaced integer overflow checks the compiler could...
Hacking a Coffee Maker
As expected, IoT devices are filled with vulnerabilities: As a thought experiment, Martin Hron, a researcher at security company Avast, reverse engineered one of the older coffee makers to see what kinds of hacks he could do with it. After just a week of effort, the unqualified answer was: quite ...
CVE-2020-9725
Adobe FrameMaker version 2019.0.6 and earlier versions lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. This could be exploited to execute arbitrary code with the privileges of the current user. User interaction is required to...
Researchers Reveal New Security Flaw Affecting China's DJI Drones
Cybersecurity researchers on Thursday revealed security issues in the Android app developed by Chinese drone-maker Da Jiang Innovations DJI that comes with an auto-update mechanism that bypasses Google Play Store and could be used to install malicious applications and transmit sensitive personal...
Leak Exposes Private Data of Genealogy Service Users
A server containing information of users of a genealogy service has exposed the data of 60,000 users, putting them at risk for fraud, phishing and other cybercriminal activity. Research led by Avishai Efrat at WizCase has discovered the leak, which affected an open and unencrypted ElasticSearch...
WordPress Form Maker by 10Web plugin <= 1.13.39 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Andy Tyler in WordPress Form Maker by 10Web plugin versions = 1.13.39. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.40...
Form Maker by 10Web < 1.13.40 - Authenticated Reflected XSS
The 'Form Maker by 10Web' WordPress plugin is vulnerable to XSS in the 'blockedipsfm' page. A logged-in site administrator who follows a crafted link will trigger arbitrary JavaScript code to be run in their browser in the context of their privileged account on the WordPress site...
Omise: Authenticity token doesnt expire after single use leading to CSRF
Summary Once you said that you ruby framework for making the authenticity-token which acts as a CSRF protection. You also send me this as to help me understand https://medium.com/rubyinside/a-deep-dive-into-csrf-protection-in-rails-19fa0a42c0ef . After finding i found that an authenticity-token c...
The vulnerability of the exif_process_IFD_in_MAKERNOTE function in the EXIF interpreter for the PHP programming language allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the exifprocessIFDinMAKERNOTE function in the EXIF interpreter for the PHP programming language is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the exif_process_IFD_in_MAKERNOTE function in the EXIF interpreter for the PHP programming language allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the exifprocessIFDinMAKERNOTE function in the EXIF interpreter for the PHP programming language is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
WordPress Form Maker 5.4.1 - SQL Injection
WordPress Form Maker plugin versions 5.4.1 and below suffer from a remote SQL injection vulnerability. Exploit Title: WordPress Plugin Form Maker 5.4.1 - 's' SQL Injection Authenticated Exploit Author: SunCSR Sun Cyber Security Research Date: 2020 - 5 - 22 Vender Homepage: https://help.10web.io/...
WordPress Plugin Form Maker 's' SQL Injection Vulnerability
WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress plugin Form Maker 's. An attacker can exploit the vulnerability to obtain sensitive information...
Form Maker by 10Web < 1.13.36 - Authenticated SQL Injection
Authenticated admin+ SQL injection in the Form Maker by 10Web WordPress Plugin 1.13.35 exists via the /wordpress/wp-admin/admin.php?page=blockedipsfm=1" s parameter. Edit WPScanTeam: - Initial reported version 5.4.1 does not exist, confirmed to be 1.13.35 by researcher - May 25th, 2020 - details...
Form Maker by 10Web < 1.13.36 - Authenticated SQL Injection
Authenticated admin+ SQL injection in the Form Maker by 10Web WordPress Plugin 1.13.35 exists via the /wordpress/wp-admin/admin.php?page=blockedipsfm=1" s parameter. Edit WPScanTeam: - Initial reported version 5.4.1 does not exist, confirmed to be 1.13.35 by researcher - May 25th, 2020 - details...
WordPress Form Maker by 10Web plugin <= 1.13.35 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability discovered by Vu Tien Hoa in WordPress Form Maker by 10Web plugin versions = 1.13.35. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.36...
Wordpress Form Maker 5.4.1 Plugin - (s) SQL Injection (Authenticated) Vulnerability
Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Form Maker 5.4.1 - 's' SQL Injection Authenticated Exploit Author: SunCSR Sun Cyber Security Research Vender Homepage: https://help.10web.io/ Version: = 5.4.1 Tested on: Ubuntu 18.04 Description: SQL injection i...
WordPress Plugin Form Maker 5.4.1 - 's' SQL Injection (Authenticated)
Exploit Title: Wordpress Plugin Form Maker 5.4.1 - 's' SQL Injection Authenticated Exploit Author: SunCSR Sun Cyber Security Research Date: 2020 - 5 - 22 Vender Homepage: https://help.10web.io/ Version: = 5.4.1 Tested on: Ubuntu 18.04 Description: SQL injection in the Form Maker by 10Web WordPres...
WordPress Form Maker 5.4.1 SQL Injection
Exploit Title: Wordpress Plugin Form Maker 5.4.1 - 's' SQL Injection Authenticated Exploit Author: SunCSR Sun Cyber Security Research Date: 2020 - 5 - 22 Vender Homepage: https://help.10web.io/ Version: = 5.4.1 Tested on: Ubuntu 18.04 Description: SQL injection in the Form Maker by 10Web WordPres...