Lark Technologies: Stored XSS in Satisfaction Surveys via "Ask Reason for Dissatisfaction" option

A stored XSS cross site scripting vulnerability was found within the Lark satisfaction survey which an attacker could have potentially used to inject malicious javascript within the "reason for dissatification" section when selecting a poor rating after a help desk chat is completed. We thank...

HCL Technologies Campaign Cross-Site Scripting Vulnerability

HCL Technologies Campaign is a suite of management solutions from HCL Technologies India to help marketers design, execute, measure and optimize marketing campaigns. A cross-site scripting vulnerability exists in HCL Technologies Campaign versions 10.1.x, 11.0.1 and 11.1.0.x. The vulnerability ca...

HCL Technologies Marketing Platform Cross-Site Scripting Vulnerability

HCL Technologies Marketing Platform is a suite of marketing platforms from HCL Technologies India. The platform supports marketers in leveraging and analyzing customer interactions on websites, mobile and social media to deliver targeted marketing campaigns to customers. A cross-site scripting...

The vulnerability of the Web UIX component of the Oracle Help Technologies development and display systems allows attackers to access, modify, or delete data, or gain unauthorized access to protected information.

The vulnerability of the Web UIX component of the Oracle Help Technologies development and display system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to, modify, add, or delete data, or to obtain unauthorized access to...

CVE-2020-14723

Vulnerability in the Oracle Help Technologies product of Oracle Fusion Middleware component: Web UIX. Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Help...

CVE-2020-14723

Vulnerability in the Oracle Help Technologies product of Oracle Fusion Middleware component: Web UIX. Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Help...

Design/Logic Flaw

Vulnerability in the Oracle Help Technologies product of Oracle Fusion Middleware component: Web UIX. Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Help...

CVE-2020-14723

Vulnerability in the Oracle Help Technologies product of Oracle Fusion Middleware component: Web UIX. Supported versions that are affected are 11.1.1.9.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Help...

CVE-2020-14723

CVE-2020-14723 affects Oracle Help Technologies (Web UIX) within Oracle Fusion Middleware. Affected versions are 11.1.1.9.0 through 12.2.1.3.0. The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Help Technologies, with human interaction required, potent...

LEAD Technologies LEADTOOLS Buffer Overflow Vulnerability (CNVD-2021-39167)

LEAD Technologies LEADTOOLS is an image processing development kit from LEAD Technologies. A buffer overflow vulnerability exists in the ANI file format parser in LEAD Technologies LEADTOOLS version 20. The vulnerability can be exploited by an attacker to execute code with the help of a specially...

Vulnerability Spotlight: Remote code execution vulnerabilities in LEADTOOLS 20

Cory Duplantis of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered a remote code execution vulnerability in the LEADTOOLS line of imaging toolkits. LEADTOOLS is a collection of toolkits designed to perform a variety of functions aimed at integrating...

Lark Technologies: Messages disclosure via search feature of other users group(Cross-Tenant).

Due to a Insecure Direct Object Reference IDOR vulnerability identified within the message search function of Lark, an attacker could have potentially viewed messages, docs, and attachments shared in other users groups. We thank @base64 for reporting this to our team and verifying the resolution...

Adobe Prompts Users to Uninstall Flash Player As EOL Date Looms

With Flash Player’s Dec. 31, 2020 kill date quickly approaching, Adobe said that it will start prompting users to uninstall the software in the coming months. The End of Life EOL timeline has been a long time coming. Adobe first announced in July 2017 that it will no longer update or distribute...

WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation

Description Props to Simon Scannell of RIPS Technologies for finding an issue where set-screen-option can be misused by plugins leading to privilege escalation...

Lark Technologies: Stored XSS & SSRF in Lark Docs

A stored XSS cross site scripting vulnerability was discovered in Lark Docs that could be escalated into a Server Side Request Forgery SSRF vulnerability if opened in a headless browser on the Lark server. The vulnerability has been resolved. We thank @mike12 for reporting this to our team and...

Trading Technologies Messaging remove_park Stack Overflow

The Trading Technologies Messaging TTM running on the remote host is affected by a remote code execution vulnerability due to the lack of validation of user-supplied data prior to copying it to a fixed-length stack-based buffer when processing a removepark message. An unauthenticated, remote...

Trading Technologies Messaging (ttm_cmd) Detection

Binary data ttttmcmddetect.nbin...

Node.js third-party modules: [wappalyzer] ReDoS allows an attacker to completely break Wappalyzer

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report VULNERABILITY in...

Lark Technologies: Stored xss in larksuite internal helpdesk and other user's helpdesk.

A stored XSS cross site scripting vulnerability was found which an attacker could have potentially used to obtain access to the internal team's help desk and view submitted user tickets. We have resolved this issue and thank @imrannisar for reporting this to our team...

Long Tail Analysis: A New Hope in the Cybercrime Battle

Our hyper-connected world and its ever-faster network speeds have resulted in mountains of diverse data that needs to be processed. It has also resulted in an ever-expanding attack surface, requiring cybersecurity solutions to scale like never before. These days, scale is about more than traffic...