CVE-2021-34675

Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports...

CVE-2021-34675

CVE-2021-34675 affects the WordPress Basix NEX-Forms plugin up to version 7.8.7. The vulnerability is an authentication bypass that allows access to stored PDF reports without valid credentials. The issue is documented across multiple sources (NVD, Red Hat, CNVD, WPVulnDB) as an authentication by...

WordPress 授权问题漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin Basix NEX-Forms in version 7.8.7 and earlier has an authentication bypass vulnerabilit...

WordPress 授权问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authorization issue vulnerability exists in the WordPress plugin Basix NEX-Forms 7.8.7 and earlie...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager

✍️ Description I found a stored XSS in your project which is lead by adding property name which reflects on summary-reports-application-leases-1.php 🕵️‍♂️ Proof of Concept Steps to reproduce: 1. Create a Property. 2. Enter x''' in the comments. 3. Save and visit...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description There is a Stored XSS on the user profile edit page which occurs due to improper sanitization of the Address field as tested on the latest release. 🕵️‍♂️ Proof of Concept Step to Reproduce: Go to /itemsview.php and add the payload: ""@x.y as Item Description and add required data and...

XXE vulnerability in seleniumhtmlreport

seleniumhtmlreport 1.0 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with the ability to control the report files parsed using this plugin to have Jenkins parse a crafted report file that uses external entities for extraction of...

Still Leading In Endpoint And Cloud Workload Security

Cloud workload security and endpoint protection are key to managing security risk. Two new independent IDC reports help CISOs consider their strategic partner options...

Tulsa’s Police-Citation Data Leaked by Conti Gang

The city of Tulsa, OK is asking some of its residents to keep a close eye on their personal and financial accounts after the Conti ransomware group leaked some 18,000 city files, mostly police citations, on the dark web. The leak stemmed from a May 6 ransomware attack that caused the city to shut...

HackerOne: Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information

When a Report is submitted on HackerOne.com, a feature called the Report Duplicate Detector helps program members and triagers find potential duplicates of the submitted report. This feature will match against all reports that were submitted to the program. When the feature was introduced, all...

CVE-2021-29084

Improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability in Security Advisor report management component in Synology DiskStation Manager DSM before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2020-22175

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\admin\betweendates-detailsreports.php. Remote unauthenticated users can exploit the vulnerability to obtain database sensitive information...

Arbitrary File Download Vulnerability in Built-in Reports of Renton Network Security Management System (CNVD-2021-47145)

Renzi Network Technology Co., Ltd. was founded in May 2000, and its business covers network security, information security, public security, network resource security, industrial internet security and many other fields, etc. etc. An arbitrary file download vulnerability exists in the built-in...

PT-2021-10740 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System in PHP version 4.0 Description: The issue concerns a SQL injection vulnerability located in the hmsadminbetweendates-detailsreports.php file. This vulnerability can be exploited by remote unauthenticated...

New Admin Portal for Akamai Enterprise Application Access

The definition of a user has evolved to comprise much more than an employee, making secure access to the right application, for the right user, at the right time difficult and complex. Akamai Enterprise Application Access EAA is a unique cloud architecture that closes all inbound firewall ports,...

Arbitrary File Download Vulnerability in Built-in Reports of Renton Network Security Management System

Renzi Network Technology Co., Ltd. was founded in May 2000, and its business covers network security, information security, public security, network resource security, industrial internet security and many other fields, etc. etc. An arbitrary file download vulnerability exists in the built-in...

SAP NetWeaver AS ABAP and ABAP Platform Authorization Issues Vulnerability

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. An authorization issue vulnerability exists in SAP NetWeaver AS ABAP and ABAP Platform, which arises from the...

CVE-2021-31201

creationtimestamp| type| source ---|---|--- 2021-06-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=593 2021-06-09 04:51:08+00:00| seen| https://t.me/alexmakus/4121 2021-11-08 08:58:18+00:00| seen| MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422 2021-11-20 09:53:52+00:00| see...

CVE-2021-31956

creationtimestamp| type| source ---|---|--- 2021-06-09 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=593 2021-06-09 04:51:08+00:00| seen| https://t.me/alexmakus/4121 2021-06-10 08:24:58+00:00| seen| MISP/df23874b-e926-4e6f-b80e-c8a58279bcb0 2021-06-15 10:49:56+00:00| see...

Getting Hosts from Microsoft Intune MDM using Python

Today I want to talk about Microsoft Intune. It is a Mobile Device Management platform. Well, I think that the importance of MDM systems has become much higher than it was before the days of covid-19. Simply because a lot more people now work remotely using corporate laptops. And if these people...