7309 matches found
Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases
More than 4,000 Android apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information on their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. The investigation, led by Bob Diachenko...
CVE-2020-11033
In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User. The response contains: - All apitokens which can be used to do privileges escalations or read/update/delete data normally non...
CVE-2020-11033
CVE-2020-11033 affects GLPI 9.1 up to before 9.4.6. An API user with READ on the User itemtype could query apirest.php/User and obtain the full user list, including all api_tokens (privilege escalation) and personal_tokens (inter-user planning). Exploitation requires the API to be enabled and a t...
Adult Cam Site CAM4 Exposed 10.88 Billion Records Online
CAM4 has taken the server offline, but not before it leaked 7TB of user data...
The vulnerability of Microprogrammed Software in Modicon Controllers arises from the existence of rigidly encrypted user data, which allows a intruder to execute any command against the Modicon Controllers.
The vulnerability of Microprogrammed Software in Modicon Controllers stems from the existence of rigidly encoded configuration data used to transmit configuration files to Modicon Controllers. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on Modicon...
The vulnerability of the Special:Redirect function in the MediaWikia hypertext environment allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Special:Redirect function in the MediaWiki software lies in the lack of protection for user-defined data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information by searching for user identities...
PT-2020-4421
Name of the Vulnerable Software and Affected Versions: jQuery versions 1.0.3 through 3.4.1 Description: The issue arises from insufficient cleaning of user-provided data when passing HTML elements to jQuery's DOM manipulation methods, such as .html and .append. This can allow an attacker to execu...
CVE-2020-11822
CVE-2020-11822 affects Rukovoditel 2.5.2. The vulnerability is a stored XSS on the Application Structure module, specifically the User Access Groups page, enabling an attacker to inject malicious script and potentially steal user data. The connected documents do not provide specific exploit code,...
GitLab: Stored XSS in group issue list
Hello Gitlab! To reproduce the bug, we need to enable the "vueissuableslist" feature in Gitlab. This feature is not enabled by default, but I think it would be better to fix this issue before this feature is permanently available. Steps to reproduce: 1. Run Gitlab docker run --detach --hostname...
Xi'an Baolian Network Technology Co., Ltd. construction system has logical flaws and vulnerabilities
Xi'an BaiLian Network Technology Co., Ltd. is the first technology company specializing in bearing industry management software development and bearing industry portal design. There is a logic flaw vulnerability in the construction system of Xi'an Bailian Network Technology Co. Attackers take...
ECshop v4.06 H5 Micro Mall has a flawed logic vulnerability
ECshop is a B2C classic open source mall system . ECshop v4.06 H5 micro-mall there is a logic flaw vulnerability, attackers can exploit the vulnerability to obtain all the user information in the mall...
WordPress Gtranslate Cross-Site Scripting Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Gtranslate versions prior to 2.8.52, which stems from...
CVE-2020-11813
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...
CVE-2019-10620
Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24...
Input validation
Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24...
CVE-2019-10620
Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24...
CVE-2020-11661
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...
CVE-2020-11661
CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...