Shopify: Publicly Accessible Datadog link

During my daily scanning of shopify and shopify's internal domain Shopify.io, I landed on a personal bookmark of an employee: █████████ who works at Guru at Shopify. The link for personal bookmark is here: ███ There is a personal bookmark called ██████████. When going to the link: ████████ it...

statistik.sachsen-anhalt.de XSS vulnerability

Open Bug Bounty ID: OBB-607952 Description| Value ---|--- Affected Website:| statistik.sachsen-anhalt.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Microsoft Windows: Set the intranet statistics server

Check Setting OpenVAS Vulnerability Test $Id: winusewustatisticserverpath.nasl 11535 2018-09-21 19:39:46Z cfischer $ Check value for Set the intranet statistics server Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free software...

Hashtopolis - A Hashcat Wrapper For Distributed Hashcracking

Hashtopolis is a multi-platform client-server tool for distributing hashcat tasks to multiple computers. The main goals for Hashtopolis's development are portability, robustness, multi-user support, and multiple groups management. The application has two parts: Agent Multiple clients C, Python,...

CVE-2014-1398: Improper Access Control

The entity wrapper access API in the Entity API module 7.x-1.x before 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors...

PT-2018-4168

Name of the Vulnerable Software and Affected Versions Entity API module versions 7.x-1.x before 7.x-1.3 Description The issue concerns the entity wrapper access API in the Entity API module for Drupal, which might allow remote authenticated users to bypass intended access restrictions on certain...

CVE-2011-3178: Improper Neutralization of Special Elements used in an OS Command

In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode...

CVE-2017-14885

CVE-2017-14885 affects WLAN components in Android for MSM/CAF stacks (wma_unified_link_peer_stats_event_handler). The issue arises because the function validates only the first peer_stats->num_rates against WMA_SVC_MSG_MAX_SIZE, not the sum of all peer_stats->num_rates (num_rates). As a res...

Inside a New DDoS Amplification Attack Vector via Memcached Servers

We recently saw a new DDoS amplification attack vector via memcached servers that culminated in two massive DDoS amplification attacks on February 28. Both attacks were mitigated successfully. Here’s how memchached servers work and how the attacks unfolded. Memcached servers Unless updated within...

WordPress WP Statistics plugin cross-site scripting vulnerability (CNVD-2018-04482)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site.WP Statistics is one of the website statistical analysis plugin. A cross-site scripting vulnerability exists in...

WordPress WP Statistics plugin cross-site scripting vulnerability (CNVD-2018-04483)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL server set up a personal blog site.WP Statistics is one of the website statistical analysis plugin. A cross-site scripting vulnerability exists in...

CVE-2018-2377

In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users...

CVE-2018-2377

The CVE-2018-2377 issue affects SAP HANA Extended Application Services 1.0. It allows unauthorized users to retrieve some general server statistics and status information, indicating a partial confidentiality impact. Root cause details are not explicitly provided beyond exposure of server metadat...

PT-2018-15510 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extended Application Services version 1.0 Description: The issue allows unauthorized users to retrieve some general server statistics and status information. Recommendations: For SAP HANA Extended Application Services version 1.0,...

CVE-2018-2377: Undefined Security Weakness

In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users...

PT-2018-15511 · Sap · Sap Hana Extended Application Services

Name of the Vulnerable Software and Affected Versions: SAP HANA Extended Application Services version 1.0 Description: The issue allows unauthorized users to read statistical data about deployed applications, including resource consumption. Recommendations: For SAP HANA Extended Application...

Design/Logic Flaw

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...

PT-2018-6627

Name of the Vulnerable Software and Affected Versions: Atlassian Fisheye and Crucible versions prior to 4.5.1 and 4.6.0 Description: The issue concerns a missing permissions check in the /rest/review-coverage-chart/1.0/data//.json resource. This allows remote attackers without access to a...

Missing permission check in review coverage REST endpoint - CVE-2017-18035

The /rest/review-coverage-chart/1.0/data//.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistic...