The vulnerability of the certificate processing component in Cisco SPA112, SPA525, and SPA5X5 Series IP phones allows a perpetrator to gain access to protected information.

The vulnerability of the certificate processing component in Microprogramming Software for Cisco SPA112, SPA525, and SPA5X5 Series devices is related to errors during certificate verification on the server side. Exploiting this vulnerability can allow an attacker to gain access to protected...

Hubei Radio and Television Station Yangtze River Cloud Android APP suffers from overstepping access vulnerability

Yangtze River Cloud Android APP is a news and information software created by Hubei Radio and Television Station, which integrates the three functions of government affairs, news and information, and life services. A vulnerability exists in the Hubei Radio and Television Changjiang Cloud Android...

Enter: IDOR on remoing Share

Issue In case of Operator Wallets, only Owner has the permission to delete share with any user. But It is possible for any user to delete share for any other user. POC 1. Suppose a wallet BITCOINS is created by user A and shared with user B and C. 2. User B can send the following request and dele...

Square: Delayed, fraudulent transactions possible with encrypted Square Reader devices due to lack of server-side verification of device transaction counter

Although Square Readers implement encryption, possibly with a Derived Unique Key Per Transaction DUKPT scheme, the transaction counter of a Square Reader device is not verified when performing server-side decryption of swipe data. During a valid sale, a malicious merchant or third party can recor...

Design/Logic Flaw

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants Versions V5.0.0 for CVE-2013-3633 and versions V4.5.0 for CVE-2013-3634, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.1.0. The user privileges for the web interface are only...

eyeOS <= 1.9.0.2 Stored XSS Vulnerability Using Image Files

Exploit for php platform in category web applications Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal messages. -...

eyeos 1.9.0.2 - Persistent Cross-Site Scripting Using Image Files

eyeos 1.9.0.2 - Persistent Cross-Site Scripting Using Image Files Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal message...

eyeos 1.9.0.2 - Persistent Cross-Site Scripting Using Image Files

Title: eyeOS alert"XSS done"; - Risks and consequences: Malicious users can inject code inside image files malware, browser exploits, etc... to attack other users and compromise the whole system via shared files or internal messages. - Mitigations: Disallow public dirs. Avoid work with images. -...

Site program-Africa SI exploits-vulnerability warning-the black bar safety net

Part I Preface Now the most popular online site attack means, to was SQL Injection, even though SI technology is easy to use, and easy to obtain greater privileges, but because of the limelight too big, now generally is a little security-conscious programmer will pay attention to this problem, an...