CVE-2018-0590: Undefined Security Weakness

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profiles via unspecified vectors...

MyBB Latest Posts on Profile Plugin 1.1 - Cross-Site Scripting

Exploit Title: MyBB Latest Posts on Profile Plugin v1.1 - Cross-Site Scripting Date: 4/20/2018 Author: 0xB9 Contact: luxorforums.com/User-0xB9 or 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=914 Version: 1.1 Tested on: Ubuntu 17.10 CVE: CVE-2018-10580 1...

Moodle 3.2.x < 3.2.2 Information Disclosure Vulnerability - Windows

Global search displays user names for unauthenticated users. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle";...

Crea8Social Cross-Site Scripting Vulnerability

Crea8social is a PHP-based social networking platform developed by Nigerian software developer Tiamiyu Waliu Kola. A cross-site scripting vulnerability exists in Crea8social version 2018.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via User Profile...

Cross-domain high-risk vulnerability in WebView component for iOS platforms

WebView is an iOS control for displaying web pages, which is based on the Webkit engine and presents a web page.In addition to the properties and settings of a typical View, WebView controls can handle URL requests, page loading, rendering, and page interactions. The iOS platform WebView componen...

Joomla Jtag Members Directory 5.3.7 SQL Injection

Title: Joomla Jtag Members Directory 5.3.7 - SQL injection Credit: Bilal KARDADOU Vendor: https://joomlatag.com URL: https://extensions.joomla.org/extensions/extension/clients-a-communities/members-lists/jtag-members-directory/ Product: 'Joomla Jtag Members Directory 5.3.7' Developer: JoomlaTag...

Joomla Jtag Members Directory 5.3.7 SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Joomla Jtag Members Directory 5.3.7 - SQL injection Credit: Bilal KARDADOU Vendor: https://joomlatag.com URL: https://extensions.joomla.org/extensions/extension/clients-a-communities/members-lists/jtag-members-directory/ Product: 'Jooml...

CVE-2017-5534

The tibbr user profiles components of tibbr Community, and tibbr Enterprise expose a weakness in an improperly sandboxed third-party component. Affected releases are TIBCO Software Inc. tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0...

CVE-2017-5534

CVE-2017-5534 affects TIBCO tibbr components (Community and Enterprise) and stems from improper sandboxing of a third-party component in the tibbr user profiles module. Affected releases include tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, and tibbr Enterprise in the same version ranges....

CVE-2017-11463

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

Design/Logic Flaw

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

CVE-2017-11463

In Ivanti Service Desk formerly LANDESK Management Suite versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference leads to referencing/updating objects belonging to other users. In other words, a normal user can send requests to a specific URI with the target user's username in...

Zomato: User Profiles Leak PII in HTML Document for Mobile Browser User Agents

@chriszielinski found that user personal information was leaking when you make a request using mobile user agent...

Tweep - An Advanced Twitter Scraping Tool

Tweep is an advanced Twitter scraping tool written in python that allows for scraping Tweets and pictures from Twitter profiles without using Twitter's API. Benefits Some of the benefits of using Tweep vs Twitter API: Fast initial setup Can be used anonymously No rate limitations Can fetch all...

Description of the security update for Outlook 2016: June 13, 2017

None None...

Appointment Script - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Doctors Appointment Script - SQL Injection Google Dork: N/A Date: 05.04.2017 Vendor Homepage: http://appointment-script.com/ Software: http://appointment-script.com/demo Demo: http://appointment-script.com/demo Version: N/A Test...

UPM Doesn't Migrate Local User Profiles Since Version 5.4.1

In UPM 5.4.1 and later versions, UPM doesn't migrate local user profiles to UPM store. Then users who are using local profile is unable to retain their personal settings by UPM...

UPM 5.2: Getting temporary profiles

Getting temporary profiles...

Profiles Are Not Written Back to User Store on Logoff

Under certain circumstances User Profiles are not written back to the UPM User Store during log off...

Nextcloud: Information disclosure

Hello Nextcloud go to https://help.nextcloud.com/users/.json for example https://help.nextcloud.com/users/amirie.json you can see the user information...