WordPress Bulk Edit and Create User Profiles – WP Sheet Editor plugin < 1.5.13 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Bulk Edit and Create User Profiles – WP Sheet Editor plugin versions 1.5.13. Solution Update the WordPress Bulk Edit and Create User Profiles – WP Sheet Editor plugin to the latest available version at...

Reentrancy allows commenter to overwrite own comments

Lines of code Vulnerability details Since the Lens platform is a blockchain-based social media platform, it's important that information relevant to users be emitted so that light clients need not continually refer to the blockchain, which can be expensive. From the docs: Events are emitted at...

CVE-2022-0233 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site Scripting

The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pmuseravatar and pmcoverimage parameters found in the /admin/class-profile-magic-admin.php file which allows attackers with...

How to Opt Out of Verizon’s Custom Experience Tracking

Unless you manually opt out of the program, Verizon will store personal information and create user interest profiles...

Bagisto 1.3.3 Client-Side Template Injection

Exploit Title: Bagisto 1.3.3 - Client-Side Template Injection Date: 11-25-2021 Exploit Author: Mohamed Abdellatif Jaber Vendor Homepage: https://bagisto.com/en/ Software Link: https://github.com/bagisto/bagisto Version: v1.3.3 Tested on: windows | chrome | firefox Exploit :. 1- register an accoun...

DonPAPI - Dumping DPAPI Credz Remotely

Dumping revelant information on compromised targets without AV detection DPAPI dumping Lots of credentials are protected by DPAPI. We aim at locating those "secured" credentials, and retreive them using : User password Domaine DPAPI BackupKey Local machine DPAPI Key protecting TaskScheduled blob...

Cross-site Scripting (XSS) - Stored in openwhyd/openwhyd

Overview The openwhyd open-source application and openwhyd.org are vulnerable to a stored cross-site scripting vulnerability via user profiles. Malicious users can inject arbitrary javascript into the username setting on their profiles which, when visited by external users, would execute javascri...

CVE-2021-33727

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system...

Information disclosure

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system...

CVE-2021-33727

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker could download the user profile of any user. With this, the attacker could leak confidential information of any user in the affected system...

Siemens SINEC NMS 信息泄露漏洞

SINEC NMS is a network management system introduced by Siemens for monitoring and managing industrial networks.A user profile download vulnerability exists in versions prior to SINEC NMS 1.0 SP2 Update 1. An attacker could exploit this vulnerability to download any user's user profile, which coul...

Safari Credential Gatherer

This module searches for Safari credentials on a Windows host. Module Options msf use post/windows/gather/credentials/safari msf postsafari show actions ...actions... msf postsafari set ACTION msf postsafari show options ...show and set options... msf postsafari run This module requires Metasploi...

Digsby Credential Gatherer

This module searches for Digsby credentials on a Windows host. Module Options msf use post/windows/gather/credentials/digsby msf postdigsby show actions ...actions... msf postdigsby set ACTION msf postdigsby show options ...show and set options... msf postdigsby run This module requires Metasploi...

Lacework: Broken link profile in the website leads to identity theft.

Hi, I have found the Broken link profile in the website where the attacker can perform identity theft. Summary : When a web application has any pages, sources, links to external 3rd party services and are broken then the attacker can claim those endpoints to successfully conduct the attack and...

PT-2021-22872 · Siemens · Teamcenter

Name of the Vulnerable Software and Affected Versions: Teamcenter versions prior to V12.4.0.8 Teamcenter versions prior to V13.0.0.7 Teamcenter versions prior to V13.1.0.5 Teamcenter versions prior to V13.2.0.2 Description: A vulnerability has been identified that could lead to an account takeove...

Deskpro Cross-Site Scripting Vulnerability

Deskpro is a suite of helpdesk software from Deskpro UK. The software includes a customer relationship management component, among other things, and offers features such as e-mail, live chat, and voice. A cross-site scripting vulnerability exists in Deskpro cloud and on-premise Deskpro in version...

CVE-2021-36696

Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting XSS vulnerability in social media links on a user profile due to lack of input validation...

Deskpro 跨站脚本漏洞

Deskpro is a suite of helpdesk software from Deskpro UK. The software includes a customer relationship management component, among other things, and offers features such as e-mail, live chat, and voice. A cross-site scripting vulnerability exists in Deskpro cloud and on-premise Deskpro in version...

Cross site scripting

The User Registration, User Profiles, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript...

CVE-2021-24450 ProfilePress < 3.1.8 - Authenticated Stored XSS

The User Registration, User Profiles, Login & Membership – ProfilePress Formerly WP User Avatar WordPress plugin before 3.1.8 did not sanitise or escape some of its settings before saving them and outputting them back in the page, allowing high privilege users such as admin to set JavaScript...