4822 matches found
Sql injection
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS Commit bb274de1751ffb9d09482fd2538f9950a94c510a . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this...
CVE-2020-6114
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS Commit bb274de1751ffb9d09482fd2538f9950a94c510a . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this...
CVE-2020-6114
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS Commit bb274de1751ffb9d09482fd2538f9950a94c510a . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this...
CVE-2020-6114
The CVE-2020-6114 issue affects Glacies IceHRM v26.6.0.OS Admin Reports. TALOS details show an exploitable SQL injection caused by improper handling of the ob parameter used to build the ORDER BY clause in data retrieval paths (core/data.php → BaseService->getData, then Find). The vulnerabilit...
Glacies IceHRM Admin Reports SQL injection Vulnerability
Summary An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS Commit bb274de1751ffb9d09482fd2538f9950a94c510a . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this...
CVE-2020-15037
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
CVE-2020-15037
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
Cross site scripting
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
CVE-2020-15037
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
CVE-2020-15037
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...
CVE-2020-15037
The CVE-2020-15037 entry concerns NeDi 1.9C, a web application where an attacker can inject arbitrary JavaScript through the Reports-Devices.php page via the st[] parameter, causing a cross-site scripting (XSS) vulnerability. The consolidated connected documents confirm the vulnerability exists i...
Airshare - Cross-platform Content Sharing In A Local Network
Airshare is a Python-based CLI tool and module that lets you transfer data between two machines in a local network, P2P, using Multicast-DNS. It also opens an HTTP gateway for other non-CLI external interfaces. It works completely offline! Built with aiohttp and zeroconf. Checkout the demo...
nexus2-oss -- NXRM2 Directory Traversal vulnerability
Sonatype reports: CVE-2020-15012: NXRM2 Directory Traversal vulnerability...
Report: ‘BlueLeaks’ Exposes Sensitive Data From Police Departments
Thousands of sensitive police department files – including police and FBI reports – were published on Friday by DDoSecrets Distributed Denial of Secrets, a self-proclaimed “transparency collective” that publishes covert data. The almost 270 gigabytes of data, dubbed “BlueLeaks,” is reportedly fro...
Citrix Interoperability Validation
Microsoft Product Updates Microsoft Security Patch Validation Reports 2025| 2024| 2023 ---|---|--- January| January| January February| February| February March| March| March April| April| April May| May| May | June| June | July| July | August| August | September| September | October| October |...
Mattermost Server Injection Vulnerability (CNVD-2020-52026)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 4.1.0, prior to 4.0.4, and prior to 3.10.3. The vulnerability can be exploited by an attacker to perform CSV injection via a...
Shopify: Get analytics token using only apps permission
It seems apps that can read "analytics" have embedded analytic token. In order to access the /admin/reportify/token.json endpoint explicit dashboard or reports permission is required. A staff member with just "apps" permission can leverage the permissions of apps that can read reports to extract...
BIND -- Remote Denial of Service vulnerability
ISC reports: The asterisk character "" is allowed in DNS zone files, where it is most commonly present as a wildcard at a terminal node of the Domain Name System graph. However, the RFCs do not require and BIND does not enforce that an asterisk character be present only at a terminal node. A...
Court Ruling on Forensic Data Breach Reporting Flying Under the Radar
One thing that may have flown under the radar in recent weeks is that a court has ruled that Capital One must allow plaintiffs to review a cybersecurity firm’s forensic report related to the bank’s 2019 data breach despite the bank’s protests that it is a protected legal document. You can read mo...
CVE-2020-14150
GNU Bison before 3.5.4 allows attackers to cause a denial of service application crash. NOTE: there is a risk only if Bison is used with untrusted input, and an observed bug happens to cause unsafe behavior with a specific compiler/architecture. The bug reports were intended to show that a crash...