Cross-site Scripting (XSS) - Stored in leantime/leantime

Description I found Stored XSS in the title of the content. Proof of Concept Step 1.First of all, build the environment with Docker and create an administrator user. 2.Next, create a new "To -DO" from "Project Dashboard" in the left menu. / 3.Next, create an account for the role of "Team Member"...

Zomato: Add upto 10K rupees to a wallet by paying an arbitrary amount

| TimeStamp | Action | |----------|:-------------:| | Wed, 24 Nov 2021, 11:24 IST | Received the report | | Wed, 24 Nov 2021, 11:25 IST | Validation and analysis of issue initiated | | Wed, 24 Nov 2021, 11:28 IST | Vulnerability reported to the respective Internal Team | | Wed, 24 Nov 2021, 11:36...

CVE-2021-1968

creationtimestamp| type| source ---|---|--- 2021-11-23 11:50:05+00:00| published-proof-of-concept| https://t.me/BlueRedTeam/1209 2022-05-08 19:29:38+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4817 2026-09-01 17:00:34+00:00| seen| https://t.me/cissp/4879 2026-09-02...

Cross-Site Request Forgery (CSRF) in star7th/showdoc

Description You set the strict flag only for one of your cookies named cookietoken but in Team management attacker still can delete or add teams with CSRF vulnerability as the cookie with name PHPSESSID don't have strict flag. Proof of Concept 1.replace 38046 with the team id 2.open poc.html and...

Registry-Recon - Cobalt Strike Aggressor Script That Performs System/AV/EDR Recon

Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon. Author: Jess Hires Description As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual tooling for this...

CVE-2021-22951

Unauthorized individuals could view password protected files using viewinline in Concrete CMS previously concrete 5 prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in viewinline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations...

CVE-2021-22951

CVE-2021-22951 affects Concrete CMS (formerly concrete5) prior to 8.5.7. Unauthorized individuals could view password-protected files via the view_inline functionality, exposing protected content. The root cause was that view_inline could render a file even if it had a password. Mitigations imple...

CVE-2021-44037

Team Password Manager aka TeamPasswordManager before 10.135.236 allows password-reset poisoning...

CVE-2021-44036

Team Password Manager aka TeamPasswordManager before 10.135.236 has a CSRF vulnerability during import...

CVE-2021-44037

Team Password Manager aka TeamPasswordManager before 10.135.236 allows password-reset poisoning...

CVE-2021-44037

Team Password Manager aka TeamPasswordManager before 10.135.236 allows password-reset poisoning...

CVE-2021-44036

Team Password Manager aka TeamPasswordManager before 10.135.236 has a CSRF vulnerability during import...

Default credentials

Team Password Manager aka TeamPasswordManager before 10.135.236 allows password-reset poisoning...

2022 Planning: A First-Year CISO Shares Her Point of View

When you're planning for the year ahead in cybersecurity, there's always part of you that's trying to play fortune-teller. You know what risks matter now, and the processes and resources you need to respond to them, but what threats might emerge over the coming 12 months — or 12 weeks, for that...

CVE-2021-44037

Team Password Manager aka TeamPasswordManager before 10.135.236 allows password-reset poisoning...

CVE-2021-44037

CVE-2021-44037 concerns Team Password Manager (TeamPasswordManager) before version 10.135.236, with a reported issue of password-reset poisoning. The core vulnerability description in the sources specifies that the product allows password-reset poisoning, but the exact root cause details are not ...

CVE-2021-44036

Team Password Manager aka TeamPasswordManager before 10.135.236 has a CSRF vulnerability during import...

CVE-2021-44036

CVE-2021-44036 affects Team Password Manager (TeamPasswordManager) before version 10.135.236, with a cross-site request forgery (CSRF) vulnerability during import. The issue is rooted in insufficient request validation across import functionality, enabling an attacker to induce unintended actions...

Team Password Manager 跨站请求伪造漏洞

Team Password Manager is a web-based team password manager. Team Password Manager suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to...

Team Password Manager 授权问题漏洞

Team Password Manager is a web-based team password manager. Team Password Manager suffers from an authorization issue vulnerability that arises from improper design or implementation during code development of a web-based system or product...