Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...

CVE-2020-9384

An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...

CVE-2020-9384

The entries describe an Insecure Direct Object Reference (IDOR) in Subex ROC Partner Settlement 10.5 Change Password. Affected component: Change Password feature; root cause: manipulation of POST parameters enabling account takeover by remote authenticated users. Impact: account compromise report...

CVE-2020-9384

An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the applicati...

PT-2020-20625 · Subex · Subex Roc Partner Settlement

Name of the Vulnerable Software and Affected Versions: Subex ROC Partner Settlement version 10.5 Description: An Insecure Direct Object Reference IDOR vulnerability in the Change Password feature allows remote authenticated users to achieve account takeover via manipulation of POST parameters. Th...

Subex ROC Partner Settlement 10.5 Insecure Direct Object Reference

=========================================================================================================== Subex ROC Partner Settlement 10.5 - Authenticated IDOR in change password function lead to account takeover...

Valve: Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large

Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of itemimagesmall and itemimagelarge. Shell injection was achieved on a publishing gateway through metacharacter injection in an item-upload path...

openSUSE Security Update : opera (openSUSE-2020-402)

This update for opera fixes the following issues : Update to version 67.0.3575.97 - DNA-84063 Open URL in new tab with Go to web address in search/copy popup and right mouse click context menu - DNA-84780 Search in Search and Copy popup opens tab in wrong position from popup window - DNA-84786...

Mail.ru: Improper access control leading to deletion of Greeting videos on {https://smtp.8mar.mail.ru/}

smtp.8mar.mail.ru was pointing to partner-operated service where it was possible to delete uploaded greetings videos. No risks for Mail.ru users or active projects were identified...

CVE-2019-20524

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter...

CVE-2019-20524

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter...

CVE-2019-20523

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter...

Cross site scripting

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter...

Cross site scripting

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter...

CVE-2019-20522

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter...

CVE-2019-20522

CVE-2019-20522 affects ilchCMS 2.1.23 and enables Cross-Site Scripting via the index.php/partner/index Link parameter. The connected sources consistently describe a client-side script execution vulnerability in ilchCMS, with no details provided on affected versions beyond 2.1.23 in public CVE rec...

CVE-2019-20523

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter...

CVE-2019-20523

CVE-2019-20523 affects ilchCMS 2.1.23, where an XSS vulnerability exists in the index.php/partner/index Name parameter. The issue allows injection of script into client-side context, as described in public sources. The NVD entry lists an overall impact of low to partial integrity impact (I:L) wit...

CVE-2019-20524

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter...

CVE-2019-20524

CVE-2019-20524 affects ilchCMS 2.1.23 and allows cross-site scripting via the Banner parameter in index.php/partner/index. The root cause is a reflected XSS vector that exposes client-side code execution opportunities when a banner parameter is manipulated, as described across multiple sources (e...