Securifi Almond Cross-Site Scripting Vulnerability (CNVD-2019-18748)

The Securifi Almond is a wireless router with a touch screen. A cross-site scripting vulnerability in the Securifi Almond, Almond+, and Almond 2015 using firmware version AL-R096, which stems from the program's failure to implement an arbitrary cross-site scripting protection mechanism, can be...

CVE-2019-19908

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmcusername parameter to passreset.php is vulnerable. Recent assessments: cinzinga at March 09, 2020 9:23pm UTC reported: I am the founder of this exploit. Google dorking...

Securifi Almond Command Injection Vulnerability (CNVD-2019-18745)

The Securifi Almond is a wireless router with a touch screen. A command injection vulnerability exists in the port forwarding feature in Securifi Almond, Almond+, and Almond 2015 using firmware version AL-R096, which can be exploited by an attacker to submit a malicious payload and take control o...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

Authentication flaw

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

CVE-2019-12476

Zoho ManageEngine ADSelfService Plus prior to version 5.0.6 contains an authentication bypass in the password-reset flow that enables a local attacker with physical access to obtain a SYSTEM shell via the restricted thick client browser by supplying a crafted sequence of keyboard input. The issue...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

Security Bulletin: Password exposure via job log in IBM Spectrum Protect Plus (CVE-2019-4385)

Summary IBM Spectrum Protect Plus may display the vSNAP CIFS password in the Spectrum Protect Plus job log Vulnerability Details CVEID: CVE-2019-4385 DESCRIPTION: IBM Spectrum Protect Plus may display the vSnap CIFS password in the IBM Spectrum Protect Plus job log. This can result in an attacker...

WordPress Convert Plus Plugin Cross-Site Request Forgery

A cross-site request forgery vulnerability exists in WordPress Convert Plus Plugin. A remote unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to a target server...

CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Zohocorp Manageengine_Adselfservice_Plus

ADSelfService-Plus-PoC CVE-2019-12476 ADSelfService Plus versi...

Apple Security Update: iOS 12.3.2

Apple recommends to install security update iOS 12.3.2 on devices iPhone 8 Plus...

Apple Security Update: iOS 12.3.2

Apple recommends to install security update iOS 12.3.2 on devices iPhone 8 Plus...

Malicious Package

Overview Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from yo...

CVE-2019-12762

CVE-2019-12762 affects Xiaomi Mi 5s Plus; a radio signal in the 198–203 kHz range can trigger touchscreen anomalies (Ghost Touch) via a transmitter/antenna hidden under a surface. Exploitation requires physical proximity; no remediation details are provided in the connected documents.

CompTIA Certification Training — Get Online Courses @ 95% OFF

The Information Technology industry has seen exponential growth over the years. It is essential for everyone to earn cybersecurity certification if you want to be a part of this growing industry. Organizations always prefer employees with strong internationally-recognized professional...

HPE Intelligent Management Center (IMC) faultFlashEventSelectFact Expression Language Injection Remote Code Execution Vulnerability

HPE Intelligent Management Center IMC is a comprehensive management platform built from the ground up to support the Failure, Configuration, Accounting, Performance and Security FCAPS model. A faultFlashEventSelectFact expression language injection remote code execution vulnerability exists in HP...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16939)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16940)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...