IBM Cloud Pak for Applications Cross-Site Scripting Vulnerability (CNVD-2022-05118)

IBM Cloud Pak for Applications is an application from IBM USA, Inc. A cross-site scripting vulnerability exists in IBM Cloud Pak for Applications, which stems from the product's lack of validation of user-side data, and could be exploited by an attacker to execute client-side code and potentially...

CVE-2021-34308

A vulnerability has been identified in JT2Go All versions V13.2, Teamcenter Visualization All versions V13.2. The BMPLoader.dll library in affected applications lacks proper validation of user-supplied data when parsing BMP files. This could result in an out of bounds read past the end of an...

IBM Cloud Pak for Applications 跨站脚本漏洞

IBM Cloud Pak for Applications is an application from IBM USA, Inc. A cross-site scripting vulnerability exists in IBM Cloud Pak for Applications, which stems from the product's lack of validation of user-side data, and could be exploited by an attacker to execute client-side code and potentially...

The Latest Pro-Trump Twitter Clone Leaks User Data on Day 1

Plus: A failed takedown in Russia, details on an FBI-sting encrypted phone, and more of the week's top security news...

Zoo Management System 1.0 Cross Site Scripting

Exploit Title: Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting XSS Date: 08/07/2021 Exploit Author: Subhadip Nag Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Server: XAMPP...

Zoo Management System 1.0 - (Multiple) Stored Cross-Site-Scripting Vulnerability

Exploit Title: Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting XSS Exploit Author: Subhadip Nag Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Server: XAMPP Description Zoo...

Android Apps in Google Play Harvest Facebook Credentials

A set of nine malicious Android apps that steal Facebook credentials were found on Google Play, which racked up a collective 5.9 million installations before Google removed them. According to Dr. Web’s malware analysts, the applications were fully functional, so that victims remained in the dark...

Online Birth Certificate System 1.1 - (Multiple) Stored Cross-Site Scripting Vulnerability

Exploit Title: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting XSS Exploit Author: Subhadip Nag Author Linkedin: www.linkedin.com/in/subhadip-nag-09/ Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/client-management-system-using-php-mysql...

QNAP Qcenter 跨站脚本漏洞

Qnap Systems QCenter is a centralized management platform from China Weilian Qnap Systems that allows you to consolidate the management of multiple QNAP NAS. A cross-site scripting vulnerability exists in QNAP Qcenter in version 1.11.1004 and earlier versions, which stems from the product's lack ...

Second colossal LinkedIn “breach” in 3 months, almost all users affected

LinkedIn has reportedly been breached—again—following reports of a massive sale of information scraped from 500M LinkedIn user profiles in the underground in May. According to Privacy Shark, the VPN company who first reported on this incident, a seller called TomLiner showed them he was in...

华为智能手机安全漏洞

Huawei phones are smartphones from Huawei, a Chinese company. A security vulnerability exists in a number of Huawei SmartPhones, which stems from a lack of effective permissions licensing and access control measures in the product. The vulnerability can be exploited by an attacker to cause the...

The vulnerability of the Magento Commerce software platform for developing and managing online stores, related to authentication errors, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Magento Commerce development and management software platform is related to authentication errors. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information and modify user data...

Basecamp: Error Page Content Spoofing or Text Injection

Target: https://gopher.hey.com/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle...

TrippLite SU2200RTXL2Ua 跨站脚本漏洞

TrippLite The TrippLite SU2200RTXL2Ua is a double conversion UPS system from TrippLite USA. Used for critical servers, network and telecom equipment. The TrippLite SU2200RTXL2Ua suffers from a cross-site scripting vulnerability that stems from a stored cross-site scripting XSS vulnerability found...

CVE-2020-22176

PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas. Remote unauthenticated users can exploit the vulnerability to obtain user sensitive information...

Responsive Tourism Website 3.1 - Remote Code Execution (RCE) (Unauthenticated)

Exploit Title: Responsive Tourism Website 3.1 - Remote Code Execution RCE Unauthenticated Date: 22.06.2021 Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14838/simple-responsive-tourism-website-using-php-free-source-code.html Version: V 3.1 Tested on: MacOS &...

Autodesk AutoCAD 缓冲区错误漏洞

Autodesk AutoCAD is a suite of professional 3D drawing software from the US-based Autodesk Corporation. A buffer error vulnerability exists in Autodesk AutoCAD that stems from a lack of proper validation of user-supplied data and can be exploited by an attacker to execute code...

Wordpress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. Wordpress plugin Fudousan 5.7.0 suffers from a cross-site...

CVE-2021-0521

In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of cross-user permissions with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-3604

Secure 8 Evalos does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database...