PT-2020-16124

Name of the Vulnerable Software and Affected Versions Mitel MiCollab versions prior to 9.2 Description The issue allows an authenticated attacker to execute arbitrary scripts due to insufficient input validation, also known as Cross-Site Scripting XSS. A successful exploit could allow an attacker...

Malware infected browser extensions stealing Chrome, Edge user data

By Waqas Avast noted that the malware is quite tricky and does not execute itself if the victim is a web developer as it will be easy for them to identify its malicious activities. This is a post from HackRead.com Read the original post: Malware infected browser extensions stealing Chrome, Edge...

Openfire 4.6.0 - 'users' Stored XSS

Exploit Title: Openfire 4.6.0 - 'users' Stored XSS Date: 2020/12/11 Exploit Author: j5s Vendor Homepage: https://github.com/igniterealtime/Openfire Software Link: https://www.igniterealtime.org/downloads/ Version: 4.6.0 POST /plugins/bookmarks/create-bookmark.jsp HTTP/1.1 Host: 192.168.137.137:90...

CVE-2020-8919

An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with...

CVE-2020-8919

An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with...

CVE-2020-8919 Information leakage in Gerrit

An information leak vulnerability exists in Gerrit versions prior to 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where a missing access check on the branch REST API allows an attacker with only the default set of priviledges to read all other user's personal account data as well as sub-trees with...

Serious Vulnerabilities in Dualog Connection Suite

TL;DR The flaws found in this maritime comms and connection suite were many, and not insignificant: Directory traversal 2FA challenge/response is performed in a client-side application Default install password SQL injection User data leakage Easily brute forcible password hashes Introduction Duri...

CVE-2020-5799

The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileged access to restricted functionality and to other users' data...

Design/Logic Flaw

The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileged access to restricted functionality and to other users' data...

ARM Reliezer Communication Server Access Disclosure

The vulnerability of the interaction protocol between the “ARM Reliezer” software and the “Server of Communications” software of the PLC EKRA system is related to the presence of a pre-set password for the database containing user account information. Exploiting this vulnerability could allow an...

Mark Goldstein Eat Spray Love Security Breach

Mark Goldstein Eat Spray Love is a mobile app about fitness by Mark Goldstein personal developer. A security vulnerability exists in the Eat Spray Love mobile app, which stems from the inclusion of a backdoor account that, when modified, could allow a user privileged access to restricted features...

Rocket.Chat: Server-side RCE through directory traversal-based arbitrary file write

Vulnerability description not provided...

Mail.ru: unclaimed subdomain special.rkeeper.ru to takeover from tilda.cc

Domain, site, application -- http://special.rkeeper.ru/ Testing environment -- OS version, browser information, settings and prerequisites to reproduce vulnerability, testing tools used, etc Steps to reproduce: 1. create account on tilda.cc 1. create a aproject then a domain will be assigned to...

Schneider Electric EcoStruxure Building Operation WebReports Cross-Site Scripting Vulnerability (CNVD-2021-29455)

Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of...

Schneider Electric EcoStruxure Building Operation WebReports Cross-Site Scripting Vulnerability

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...

Import and export users and customers < 1.16.3.6 - CSV Injection

The plugin did not validate or sanitise user data, such as first and last names from the profile, leading to a CSV injection when the data is exported by an administrator...

Unspecified Vulnerability in Multiple Apple Products (CNVD-2020-65928)

Apple iOS and others are products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple tvOS is a smart TV operating system. tvOS is a smart TV operating system. tvOS is a smart TV operating system. tvOS is a smart TV operating system. tvOS is a smart TV operating...

Vulnerability in Bumble dating app risked data of 100 million users

By Sudais Asif It took Bumble 255 days to respond and fix some of the vulnerabilities reported by the researcher. This is a post from HackRead.com Read the original post: Vulnerability in Bumble dating app risked data of 100 million users...

Magento Commerce XSS

The vulnerability of the Magento Commerce software platform for developing and managing online stores exists due to insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor to execute malicious JavaScript code using specially crafted HTTP requests...

SQL Injection Vulnerability in Shield Spirit Voting Voter System for Front-end User Modification Data

Shield Spirit Voting Powder Sucking System can be applied to the public number, through the WeChat public number of the message interface to collect the user to send the vote number of the data to reach the vote, with anti-brush voting voting function, but also efficiently suck the live powder...