15694 matches found
CVE-2021-20355
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 194891...
CVE-2021-38871
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...
CVE-2021-38879
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 209057...
CVE-2021-20543
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 198929...
Security Bulletin: Rational Team Concert (RTC) and IBM Engineering Workflow Management (EWM) OpenSSL vulnerability CVE-2021-4044
Summary There is a vulnerability CVE-2021-4044 which affects Rational Team Concert RTC and IBM Engineering Workflow Management EWM. Vulnerability Details CVEID:CVE-2021-4044 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by invalid handling of...
Defending Against Scheduled Task Attacks in Windows Environments
Scheduling tasks is one of the most popular attack techniques used by threat actors to establish persistence on a victim’s machine. The Qualys Research Team investigated different ways that attackers could use to conceal scheduled tasks. In this blog, we describe three new techniques to hide and...
SharpSniper - Find Specific Users In Active Directory Via Their Username And Logon IP Address
Often a Red Team engagement is more than just achieving Domain Admin. Some clients will want to see if specific users in the domain can be compromised, for example the CEO. SharpSniper is a simple tool to find the IP address of these users so that you can target their box. It requires that you ha...
MAL-2022-3711 Malicious code in hub-project-team-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7c794f406836eb00a75225254917bf75481a01646687d3e3ee49973962b3872 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-122 Malicious code in @bitmex-frontend-team/segment-analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3be52fff1327aa2cd3337a927eff4fcf771e6042a6284a1efe3e8032c4012019 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cervantes - Collaborative Platform For Pentesters Or Red Teams Who Want To Save Time To Manage Their Projects, Clients, Vulnerabilities And Reports In One Place
Cervantes is an opensource collaborative platform for pentesters or red teams who want to save time to manage their projects, clients, vulnerabilities and reports in one place. Features OpenSource Multiplatform Multilanguage Team Collaboration BuiltIn dashbaords and analytics Manage your clients...
WordPress DynamicWebLab Team Manage plugin跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress DynamicWebLab Team Manage plugin 1.6.9 and earlier versions have a cross-site scripting...
CVE-2022-31912
Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=deleteteam...
CVE-2022-31911
Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=deleteteam...
CVE-2022-31912
Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=deleteteam...
CVE-2022-31912
Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=deleteteam...
PT-2022-20985 · Unknown · Online Discussion Forum Site
Name of the Vulnerable Software and Affected Versions: Online Discussion Forum Site version 1.0 Description: The issue concerns a SQL Injection vulnerability via the "/odfs/classes/Master.php?f=delete team" API endpoint. This allows for potential unauthorized access and manipulation of database...
Online Tutor Portal Site SQL注入漏洞
Sourcecodester Online Discussion Forum Site is an application of Sourcecodester. A SQL injection vulnerability exists in Online Tutor Portal Site v1.0, which originates from /otps/classes/Master.php?f=deleteteam missing SQL data filter escaping. An attacker could use this vulnerability to execute...
Elasticsearch Database Mess Up Exposed Login, PII Data of 30,000 Students
By Deeba Ahmed The misconfigured Elasticsearch database apparently belonged to the US-based software solution provider Transact Campus. SafetyDetectives’ cybersecurity research team… This is a post from HackRead.com Read the original post: Elasticsearch Database Mess Up Exposed Login, PII Data of...
Stealthy Symbiote Linux malware is after financial institutions
Symbiote, a new "nearly impossible to detect" Linux malware, targeted financial sectors in Latin America—and the threat actors behind it might have links to Brazil. These findings were revealed in a recent report, a joint effort between the Blackberry Research Team and Dr. Joakim Kennedy, a...