4321 matches found
CVE-2019-7753
The connected documents confirm CVE-2019-7753 applies to Verydows 2.0, with an XSS vulnerability exposed via the index.php?m=api&c=stats&a=count referrer parameter. Red Hat and NVD entries corroborate this issue, describing an input/referrer parameter that can inject scripts. No public exploit de...
PT-2019-18744
Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description The issue is related to a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices worldwide is not available. The problem can be exploited through the...
PT-2019-5684
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.2.6 Description The issue is related to a use-after-free in the show numa stats function of the Linux kernel's NUMA system, caused by the inappropriate freeing of NUMA fault statistics. This can potentially all...
CVE-2018-19464
Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...
Code injection
Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...
CVE-2018-19464
Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...
Keepalived Information Disclosure Vulnerability
Keepalived is a routing software written in C. It is mainly used for load balancing and fault detection. The software is mainly used for load balancing and fault detection. An information disclosure vulnerability exists in keepalived version 2.0.8, which originates from the creation of a new...
CVE-2018-19111
The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrated by device make, model, and OS...
CVE-2018-19111: Cleartext Transmission of Sensitive Information
The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrated by device make, model, and OS...
PT-2018-14810
Name of the Vulnerable Software and Affected Versions Google Cardboard application version 1.8 for Android Google Cardboard application version 1.2 for iOS Description The issue concerns the transmission of potentially private cleartext information to the Unity 3D Stats web site. This includes...
glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service
A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service...
Iron Mind: Defending Against Propaganda & Counter Victimization
Thomas Jefferson had it right. Propaganda is the greatest threat to any democracy. Or did you just believe a quote that I made up with a picture of him to add credence to this blog? Iron Palm or Iron Hand is a body of training techniques in various martial arts. It is originally one of the 72 art...
glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service
A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service...
glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service
A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service...
CVE-2018-14659
A flaw was found in glusterfs server which allowed clients to create io-stats dumps on server node. A remote, authenticated attacker could use this flaw to create io-stats dump on a server without any limitation and utilizing all available inodes resulting in remote denial of service...
Chaturbate: Missing CSRF Protection in /stats EndPoint.
EndPoint /affiliates/stats. doesnot verify the CSRF Tokens Steps To Reproduce: 1. Login with the your account 2. Navigate to the URL https://chaturbate.com/affiliates/stats.. 3. Check the stats in default its todays date or this week in select period. 4. Intercept the request and change the...
Chaturbate: No rate limit in stats api token endpoint
Brute force on statsapi endpoint to view stats of an user Steps To Reproduce: 1. Stats api token can be generated at https://chaturbate.com/statsapi/authtoken/ https://chaturbate.com/statsapi/?username=hackeronetestchat&token=vulnerable I've used my profile and and my token to check brute force T...
Open redirect
The Feed Statistics plugin before 4.0 for WordPress has an Open Redirect via the feed-stats-url parameter...
