CVE-2020-5905

Summary of CVE-2020-5905: In BIG-IP, the Configuration utility (TMUI) on the Network > WCCP page fails to sanitize all user-provided data before display, enabling an XSS-style attack when accessed by an authenticated administrator. Affected versions are BIG-IP 11.6.1–11.6.5.2 (per F5 advisory)...

CVE-2019-4706

CVE-2019-4706 affects IBM Security Identity Manager Virtual Appliance versions 7.0.2 and 7.0.1. The vulnerability is that ISIM VA writes information to log files that can be of a sensitive nature, potentially exposing sensitive user information or guiding an attacker. IBM’s bulletin confirms the ...

Apache Archiva < 2.2.5 LDAP Injection Vulnerability

Apache Archiva is prone to an LDAP injection vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:archiva"; if...

Web skimming with Google Analytics

Web skimming is a common class of attacks generally aimed at online shoppers. The principle is quite simple: malicious code is injected into the compromised site, which collects and sends user-entered data to a cybercriminal resource. If the attack is successful, the cybercriminals gain access to...

The vulnerability of Panasonic Video Insight VMS software arises from insufficient verification of data provided by users. This allows a hacker to execute arbitrary code.

The vulnerability of Panasonic Video Insight VMS software lies in the insufficient verification of data provided by users. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted malicious request...

Beijing Liangjing Zhicheng Technology Co., Ltd.'s Liangjing Mall Online Shop Shopping System Has Logic Flaws and Vulnerabilities

Liangjing Mall online store shopping system is a set of different types of goods, flexible multi-functional online store system, three-tier distribution PC + mobile + micro-site. Beijing Liangjing Zhicheng Technology Co., Ltd. Liangjing Mall online shopping system has a logic flaw vulnerability...

Unauthorized Access Vulnerability in the National Student Management Information System for Secondary Vocational Schools

National Secondary Vocational School Student Management Information System is a student information management system. An unauthorized access vulnerability exists in the National Secondary Vocational School Student Management Information System, which can be exploited by an attacker to obtain use...

Open-Xchange: XSS on opening malicious OpenOffice presentation document

Title Opening a malicious OpenOffice presentation document may lead to cross site scripting XSS attacks Description When generating HTML content for drawings present in odp file, a div is generated by Drawing.java. The attribute target of this div is directly constructed from the field target...

Cisco Application Services Engine Access Control Error Vulnerability

Cisco Application Services Engine is the United States Cisco Cisco company's set of common platform for the deployment of Cisco data center applications. The keystore in Cisco Application Services Engine versions prior to 1.1.2.20 is vulnerable to an Access Control Error vulnerability that stems...

New users can read all Nextcloud Deck data from previous user with same username (NC-SA-2021-007)

A logic error in Nextcloud Deck 1.0.1 allowed new users with a duplicate user identifier to use deck data of a previous deleted user...

CVE-2020-4244

IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration. IBM X-Force ID: 175422...

Bastard App Has Logic Flaw Vulnerability

Bastard App is an entertainment and creative community. There is a logic flaw vulnerability in Bastard APP. Attackers can use proxy tools to tamper with packets to obtain sensitive user information...

Possible Strong Parameters Bypass in ActionPack

There is a strong parameters bypass vector in ActionPack. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the...

Logic flaw vulnerability in Extreme CMS (CNVD-2020-33073)

Extreme CMS is an open source and free PHPCMS web content management system. A logic flaw vulnerability exists in Extreme CMS. Attackers can use the vulnerability to overstep their rights to delete or modify the database of other users goods...

Updated glpi packages fix security vulnerabilities

Updated glpi packages fix security vulnerabilities: In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges...

Slack: Stored XSS through PDF viewer

Slack allows users to upload files to their Workspace to facilitate sharing information between team members as well as with other workspaces. In addition, with the aim of easing access to PDF files, Slack provides its own "PDF Viewer" https://app.slack.com/pdf-viewer embedded in the application...

Exclusive: Hacker selling 500 million Facebook user data from 82 countries

By Waqas The entire database is being sold for $30,000 on a hacker forum. This is a post from HackRead.com Read the original post: Exclusive: Hacker selling 500 million Facebook user data from 82 countries...

Logic flaws exist in the YiYu enterprise building system vulnerability

Eyou content management system EyouCms belongs to Hainan Zanzan Network Technology Co., Ltd. is the newest PHP open source website management system. EyouCms has a logic flaw vulnerability that can be exploited by attackers to tamper with other users' information...

CVE-2020-12257

rConfig 3.9.4 is vulnerable to cross-site request forgery CSRF because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form add a user, delete a user, or edit a user...

keycloak: problem with privacy after user logout

A flaw was found in Keycloak. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section...