X (Formerly Twitter): IDOR and statistics leakage in Orders

Description: Twitter on its service "MoPub" statistics dedicated to the results of "Order", after the test shows that the endpoint "https://app.mopub.com/web-client/api/orders/stats/query" is infected with a "IDOR " bug Which led to the leak of private statistics "Orders" by another users Steps T...

XSLeaks attack analysis-HTTP caching and cross-site leakage-vulnerability warning-the black bar safety net

0x1 XSSearch past lives This attack is the earliest can be dated back to 10 years agoi.e. 2009, one named Chris Evans, security personnel describes one of the Yahoo attack: Chris use a malicious web site to search for the site visitor's e-mail Inbox, and he by constructing different keywords mann...

WordPress Plugin WordPress-Feed-Statistics Open Redirect Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An open redirect vulnerability exists in the WordPress plugin WordPress-Feed-Statistics. An attacker can successfully launch a phishing scam and steal user...

WordPress Feed Statistics 4.1 Open Redirection

Exploit Title : WordPress 4.9.2 WordPress-Feed-Statistics Plugins 4.1 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 29/03/2019 Vendor Homepage : chrisfinke.com Software Download Link :...

CVE-2018-20212

bin/statistics in TWiki 6.0.2 allows cross-site scripting XSS via the webs parameter...

CVE-2018-20212

CVE-2018-20212 affects TWiki 6.0.2, specifically the bin/statistics component, where the webs parameter enables cross-site scripting (XSS). The vulnerability is described as a parameter-based XSS in TWiki/bin/statistics, with CVSS vectors indicating network attack, low to moderate complexity, and...

CVE-2018-20212: Improper Neutralization of Input During Web Page Generation

bin/statistics in TWiki 6.0.2 allows cross-site scripting XSS via the webs parameter...

PT-2019-10017

Name of the Vulnerable Software and Affected Versions: TWiki version 6.0.2 Description: The issue allows cross-site scripting XSS via the webs parameter in the bin/statistics endpoint. Recommendations: For TWiki version 6.0.2, update to a version that fixes this issue to prevent cross-site...

Guizhou statistics release app has override access vulnerability

Guizhou statistics release app is a Bijie area set release of statistical information and participate in the questionnaire survey mobile client. Guizhou Statistics Release app has an override access vulnerability. An attacker can exploit this vulnerability to obtain sensitive information...

Guizhou statistics release app has arbitrary account login vulnerability

Guizhou statistics release app is a Bijie area set release of statistical information and participate in the questionnaire survey mobile client. Guizhou Statistics Release app has an arbitrary account login vulnerability. An attacker can exploit this vulnerability to obtain sensitive information...

CVE-2019-1667 Cisco HyperFlex Arbitrary Statistics Write Vulnerability

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the...

CVE-2019-1667 Cisco HyperFlex Arbitrary Statistics Write Vulnerability

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the...

Authentication flaw

A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted request...

CVE-2019-1667

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the...

Authorization

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the...

CVE-2019-1666 Cisco HyperFlex Unauthenticated Statistics Retrieval Vulnerability

A vulnerability in the Graphite service of Cisco HyperFlex software could allow an unauthenticated, remote attacker to retrieve data from the Graphite service. The vulnerability is due to insufficient authentication controls. An attacker could exploit this vulnerability by sending crafted request...

Scalable Fuzzing Infrastructure: ClusterFuzz

ClusterFuzz is a scalable fuzzing infrastructure which finds security and stability issues in software. It is used by Google for fuzzing the Chrome Browser, and serves as the fuzzing backend for OSS-Fuzz . ClusterFuzz provides many features which help seamlessly integrate fuzzing into a software...

PT-2019-14754

Name of the Vulnerable Software and Affected Versions Cisco HyperFlex software versions prior to 3.52a Description The issue is related to insufficient authorization controls in the Graphite interface, allowing an authenticated, local attacker to write arbitrary data. This can be exploited by...

CVE-2019-1667: Insufficient Verification of Data Authenticity

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the...

Cisco HyperFlex Arbitrary Statistics Write Vulnerability

A vulnerability in the Graphite interface of Cisco HyperFlex software could allow an authenticated, local attacker to write arbitrary data to the Graphite interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by connecting to the...