CVE-2022-29414

Multiple 13x Cross-Site Request Forgery CSRF vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin mass update settings, manage subscriptions add a new subscription, update subscription, delete Subscription...

Malicious Packages

exchangeclients and rush-lib are malicious packages. The packages contains empty README files but the strings: "rukkaz package" or "azbit package" present in the metadata. The packages are created to abuse the dependency confusion vulnerability. The malicious code executes upon installation and...

CVE-2022-26644

Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via parameters on user profile, systeminfo and accounts management...

CVE-2022-26644

The CVE-2022-26644 entry concerns Online Banking System Protect v1.0 with multiple cross-site scripting (XSS) flaws exploitable through parameters on user profile, system_info, and accounts management. This is documented across multiple sources (NVD/Red Hat and PT Security). Root cause is XSS in ...

PT-2022-17976

Name of the Vulnerable Software and Affected Versions Online Banking System Protect version 1.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are accessible via parameters on the user profile, system info, and accounts management pages...

CVE-2021-24988

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprssdismissaddonnotice AJAX action missing authorisation and CSRF checks, allowing any authenticated...

CVE-2021-24988

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprssdismissaddonnotice AJAX action missing authorisation and CSRF checks, allowing any authenticated...

CVE-2021-24988

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprssdismissaddonnotice AJAX action missing authorisation and CSRF checks, allowing any authenticated...

CVE-2021-24988

The CVE affects the WordPress WP RSS Aggregator plugin, versions prior to 4.19.3. Root cause: unsanitised/uncleaned data output in the System Info admin dashboard due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks. Impact: stored XSS where an authenticated use...

Online Traffic Offense Management System 1.0 - Multiple RCE (Unauthenticated)

Exploit Title: Online Traffic Offense Management System 1.0 - Multiple RCE Unauthenticated Date: 07/10/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link:...

Simple Water Refilling Station Management System 代码问题漏洞

Simple Water Refilling Station Management System is a simple water refilling station management system . A code issue vulnerability exists in Simple Water Refilling Station Management System 1.0, which originates in classes/ System Logo option and updatesettings on the systeminfo page in...

Backdoor.Win32.NerTe.772 Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/464d7073f884b586b17950eef2908a6eB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.NerTe.772 Vulnerability: Unauthenticated Remote Command Execution Description: The...

Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting

Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting Date: 16-05-2021 Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html Version:...

Backdoor.Win32.Antilam.14.d Code Execution

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/a53351e8fa0cb4f7db3d0250387a0e4f.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Antilam.14.d Vulnerability: Unauthenticated Remote Command Execution Description: The...

Simple Chatbot Application 1.0 Cross Site Scripting

Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting Date: 16-05-2021 Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html Version:...

Microsoft shares details of malware attack on aerospace, travel sector

By Habiba Rashid The malware allows attackers to steal credentials, take screenshots, webcam data, browser, clipboard data, system, and network info. This is a post from HackRead.com Read the original post: Microsoft shares details of malware attack on aerospace, travel sector...

Backdoor.Win32.Backlash.101 Missing Authentication

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/4ba3c08d8ad964328f2b6f618f714df2.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Backlash.101 Vulnerability: Missing Authentication Description: BackLash Server 1.0...

Trojan-Spy.Win32.WebCenter.a Information Disclosure

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/e3cf225a94c6be5a26fc21a1ec83f418.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.WebCenter.a Vulnerability: Information Disclosure Description: The trojan creates a...

Edimax Technology Ipcam Ic-3116w and Edimax Technology Ipcam Ic-3140w Buffer Error Vulnerability

Edimax Technology Ipcam Ic-3116w and Edimax Technology Ipcam Ic-3140w are both webcams from China-based Edimax Technology. A security vulnerability exists in the Edimax Technology IP-Camera IC-3116W v3.06 and IC-3140W v3.07, which is an overflow in the binary ipcam cgi due to the lack of a...

CVE-2020-13772

In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required...