Vulnerabilities fixed in Xen

Xen developers have fixed vulnerabilities in the hypervisor. The vulnerability with reference CVE-2020-25604 makes it possible for a local malicious person who can migrate timers between vCPU-s to cause a denial-of-service. The vulnerability with attribute CVE-2020-25595 allows a local malicious...

Mail.ru: [my.games, lootdog.io] XSS via MCS Bucket

Proxy pass for the path in my.games and lootdog.io domains was misconfigured to point to the root of public S3 storage, allowing to place static content in the domain path leading to XSS possibility...

CVE-2020-12621

The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...

CVE-2020-12621

The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...

Design/Logic Flaw

The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...

CVE-2020-12621

CNVD-2021-30165 indicates an encryption issue in Android Teamwire 5.3.0, where the encryption implementation does not properly use cryptographic algorithms, causing content to be not properly encrypted or stored in plaintext. A remote attacker could exploit this via cryptographically related comp...

CVE-2020-12621

The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...

Curfew e-Pass Management System 1.0 SQL Injection Vulnerability

Curfew e-Pass Management System version 1.0 suffers from multiple remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to gh1mau. Exploit Title: Curfew e-Pass Management System 1.0 Multiple SQL Injection Vulnerabilities Exploit Author: Mucahit...

Curfew e-Pass Management System 1.0 SQL Injection

Exploit Title: Curfew e-Pass Management System 1.0 Multiple SQL Injection Vulnerabilities Google Dork: N/A Date: 04.08.2020 Exploit Author: Mucahit Karadag Vendor Homepage: https://products.phpgurukul.com/product/curfew-e-pass-management-system-project-report/ Software Link:...

Citrix Single Sign-On (SSONSVR.exe) Fails to Start on Computers using Intel Credentials Manager

Pass through authentication is not working and SSONSVR.exe does not appear in Task Manager...

business.grantspasschamber.org Cross Site Scripting vulnerability OBB-1231548

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Curfew e-Pass Management System 1.0 SQL Injection Exploit

Exploit for php platform in category web applications Exploit Title: Curfew e-Pass Management System - 'searchdata' SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Curfew e-Pass Management System 1.0 SQL Injection

Exploit Title: Curfew e-Pass Management System - 'searchdata' SQL Injection Date: 2020-07-07 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/curfew-e-pass-management-system-using-php-and-mysql/ Software...

Cross site request forgery (csrf)

An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wpoptions table, such as the login and pass...

am.ik.home:uaa-server (>=1.0.0 <=1.2.0), at.porscheinformatik.zanata:common (>=4.7.0 <=4.7.8) +2713 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.2.0.Alpha1 <=5.2.4.Final)

org.hibernate:hibernate-validator MAVEN version =5.2.0.Alpha1, =1.0.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1, =1, =10 and more Source cves: CVE-2017-7536 Source advisory: OSV:GHSA-XXGP-PCFC-3VGC...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for WebSphere MQ Internet Pass-Thru - April 2020 - Includes Oracle April 2020 CPU (CVE-2020-2781)

Summary WebSphere MQ Internet Pass-Thru has addressed the following vulnerability in IBM® Runtime Environment Java™ Version 7.0.10.50 and earlier. This issue was disclosed as part of the IBM Java SDK updates in April 2020. Vulnerability Details CVEID: CVE-2020-2781 DESCRIPTION: An unspecified...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for WebSphere MQ Internet Pass-Thru - Jan 2020 - Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590

Summary WebSphere MQ Internet Pass-Thru has addressed the following vulnerability in IBM® Runtime Environment Java™ Version 7.0.10.50 and earlier. This issue was disclosed as part of the IBM Java SDK updates in January 2020. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java...

Cross-site Request Forgery (CSRF)

intelliants/subrion is vulnerable to cross-site request forgery CSRF. The vulnerability exists as it improperly invalidates the CSRF token for the panel/uploads/read.json GET request, potentially causing deletion of a file pass when the cmd=rm parameter value is set...

HiveJack - This Tool Can Be Used During Internal Penetration Testing To Dump Windows Credentials From An Already-Compromised Host

This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Often, this i...

Easy2Pilot 8 SQL Injection / Cross Site Request Forgery

==================================================================================================================================== | Title : easy2Pilot V8 Auth By Pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit | | Vendo...