CVE-2020-6882

ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The remote attacker could use this credential to connect to the MQTT server, so as to obtain information about other devices by sending specifi...

Information Disclosure

nodebb is vulnerable to information disclosure. The topics that have been deleted are hidden for moderators but not for an administrator...

Information Disclosure

type-graphql is vulnerable to information disclosure. The full resolver source is disclosed in error messages when no subscription topics are provided due to improper parsing of the target parameter in MissingSubscriptionTopicsError.ts...

Information Exposure

Overview Versions of type-graphql prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request. Recommendation Upgrade to version 0.17.6 or later...

winrar 5.80 - XML External Entity Injection Exploit

Exploit Title: winrar 5.80 - XML External Entity Injection Exploit Author: albalawi Vendor Homepage: https://win-rar.com/fileadmin/winrar-versions/winrar-x64-58b2.exe Version: 5.80 Tested on: Microsoft Windows Version 10.0.18362.418 64bit POC 1- python -m SimpleHTTPServer listens Port 8000 2- ope...

A Look Into Continuous Efforts By Chinese Hackers to Target Foreign Governments

Phishing is still one of the widely used strategies by cybercriminals and espionage groups to gain an initial foothold on the targeted systems. Though hacking someone with phishing attacks was easy a decade ago, the evolution of threat detection technologies and cyber awareness among people has...

PT-2019-4894 · Eclipse +3 · Eclipse Mosquitto +3

Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 1.5.0 through 1.6.5 Description: The issue is related to insufficient exception state checking, which can be exploited by a remote attacker to cause a denial of service. This can happen when a malicious MQTT client...

Unauthorized Access Vulnerability in AliCloud IoT Platform

AliCloud IoT Platform is a cloud service platform for the IoT field, which communicates through mainstream IoT protocols e.g., MQTT, allowing IoT projects to be built between smart devices and the cloud. An unauthorized access vulnerability exists in the AliCloud IoT platform, which can be...

WordPress bbp-move-topics plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bbp-move-topics is a theme post migration plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

WordPress bbp-move-topics plugin injection vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bbp-move-topics is a theme post migration plugin used in it. The WordPress bbp-move-topics plugin suffers from an injection...

CVE-2018-21006

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF...

CVE-2018-21005

The bbp-move-topics plugin before 1.1.6 for WordPress has code injection...

CVE-2018-21005

The bbp-move-topics plugin before 1.1.6 for WordPress has code injection...

CVE-2018-21006

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF...

Code injection

The bbp-move-topics plugin before 1.1.6 for WordPress has code injection...

Cross site request forgery (csrf)

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF...

CVE-2018-21006

CVE-2018-21006 affects the WordPress plugin bbp-move-topics prior to version 1.1.6. The vulnerability is a CSRF flaw that could allow an attacker to cause unintended requests/actions on behalf of an authenticated user. The root cause is CSRF in the bbp-move-topics plugin, as documented in multipl...

CVE-2018-21006

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF...

CVE-2018-21005

The bbp-move-topics plugin before 1.1.6 for WordPress has code injection...

CVE-2018-21005

The affected software is the WordPress plugin bbp-move-topics, prior to version 1.1.6. The vulnerability is a code injection issue in the plugin. The connected sources confirm the name, affected component, and root cause, but do not provide explicit exploitation details or a published remediation...