1958 matches found
Cisco Firepower Management Center Software and Firepower Threat Defense Software sftunnel Pass the Hash Vulnerability
A vulnerability in the sftunnel functionality of Cisco Firepower Management Center FMC Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation...
Detecting Microsoft 365 and Azure Active Directory Backdoors
Mandiant has seen an uptick in incidents involving Microsoft 365 M365 and Azure Active Directory Azure AD. Most of these incidents are the result of a phishing email coercing a user to enter their credentials used for accessing M365 into a phishing site. Other incidents have been a result of...
Superstar Learning Access App has information leakage vulnerability
Beijing Century Super Star Information Technology Development Co., Ltd. is an education informatization enterprise driven by technology, product and service innovation. An information leakage vulnerability exists in Super Star Learning Pass App, which can be exploited by attackers to obtain...
Vulnerabilities fixed in Xen
Xen developers have fixed vulnerabilities in the hypervisor. The vulnerability with reference CVE-2020-25604 makes it possible for a local malicious person who can migrate timers between vCPU-s to cause a denial-of-service. The vulnerability with attribute CVE-2020-25595 allows a local malicious...
Mail.ru: [my.games, lootdog.io] XSS via MCS Bucket
Proxy pass for the path in my.games and lootdog.io domains was misconfigured to point to the root of public S3 storage, allowing to place static content in the domain path leading to XSS possibility...
CVE-2020-12621
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
CVE-2020-12621
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
Design/Logic Flaw
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
CVE-2020-12621
The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-code component...
CVE-2020-12621
CNVD-2021-30165 indicates an encryption issue in Android Teamwire 5.3.0, where the encryption implementation does not properly use cryptographic algorithms, causing content to be not properly encrypted or stored in plaintext. A remote attacker could exploit this via cryptographically related comp...
Curfew e-Pass Management System 1.0 SQL Injection
Exploit Title: Curfew e-Pass Management System 1.0 Multiple SQL Injection Vulnerabilities Google Dork: N/A Date: 04.08.2020 Exploit Author: Mucahit Karadag Vendor Homepage: https://products.phpgurukul.com/product/curfew-e-pass-management-system-project-report/ Software Link:...
Curfew e-Pass Management System 1.0 SQL Injection Vulnerability
Curfew e-Pass Management System version 1.0 suffers from multiple remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to gh1mau. Exploit Title: Curfew e-Pass Management System 1.0 Multiple SQL Injection Vulnerabilities Exploit Author: Mucahit...
Citrix Single Sign-On (SSONSVR.exe) Fails to Start on Computers using Intel Credentials Manager
Pass through authentication is not working and SSONSVR.exe does not appear in Task Manager...
business.grantspasschamber.org Cross Site Scripting vulnerability OBB-1231548
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Curfew e-Pass Management System 1.0 SQL Injection
Exploit Title: Curfew e-Pass Management System - 'searchdata' SQL Injection Date: 2020-07-07 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/curfew-e-pass-management-system-using-php-and-mysql/ Software...
Curfew e-Pass Management System 1.0 SQL Injection Exploit
Exploit for php platform in category web applications Exploit Title: Curfew e-Pass Management System - 'searchdata' SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...
Cross site request forgery (csrf)
An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wpoptions table, such as the login and pass...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for WebSphere MQ Internet Pass-Thru - April 2020 - Includes Oracle April 2020 CPU (CVE-2020-2781)
Summary WebSphere MQ Internet Pass-Thru has addressed the following vulnerability in IBM® Runtime Environment Java™ Version 7.0.10.50 and earlier. This issue was disclosed as part of the IBM Java SDK updates in April 2020. Vulnerability Details CVEID: CVE-2020-2781 DESCRIPTION: An unspecified...
Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU for WebSphere MQ Internet Pass-Thru - Jan 2020 - Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590
Summary WebSphere MQ Internet Pass-Thru has addressed the following vulnerability in IBM® Runtime Environment Java™ Version 7.0.10.50 and earlier. This issue was disclosed as part of the IBM Java SDK updates in January 2020. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK, Java...
Cross-site Request Forgery (CSRF)
intelliants/subrion is vulnerable to cross-site request forgery CSRF. The vulnerability exists as it improperly invalidates the CSRF token for the panel/uploads/read.json GET request, potentially causing deletion of a file pass when the cmd=rm parameter value is set...