CVE-2021-27610

SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by maliciou...

CVE-2021-27610

CVE-2021-27610 affects SAP NetWeaver ABAP Server and ABAP Platform (versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804). The root cause is improper authentication due to failure to present internal and external RFC user information in a consistent, distinguished format, potential...

PT-2021-18641 · Unknown · Network Camera Device

Name of the Vulnerable Software and Affected Versions: Network camera device affected versions not specified Description: The issue concerns the manage users profile services of the network camera device, which allows an authenticated remote attacker to modify URL parameters and amend a user's...

CVE-2020-35243

Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb...

squid: Improper input validation in request allows for proxy manipulation

A flaw was found in squid. The absolute URL of a request can include the decoded UserInfo username and password for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a...

TimeClock Software 1.01 SQL Injection

!/usr/bin/python3 Exploit Title: TimeClock Software 1.01 Authenticated Time-Based SQL Injection Date: July 21, 2020 Exploit Author: François Bibeau Co Author: Tyler Butler, http://tbutler.org, https://twitter.com/tbutler0x90 Vendor Homepage: http://timeclock-software.net/ Software Link:...

GHSA-8QX4-R7FX-XC4V Malicious Package in requst

All versions of requst typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

GHSA-HG5Q-RJ62-C43G Malicious Package in reqest

All versions of reqest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

Malicious Package

All versions of 4equest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process w...

openSIS SQL Injection Vulnerability (CNVD-2020-50956)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the passwordstfemail parameter in the password reset page /opensis/ResetUserInfo.php in OS4Ed openSIS 7.3, which can be exploited by an attacker to obtain information by...

Hackers Breach 3.5 Million MobiFriends Dating App Credentials

The credentials of 3.5 million users of MobiFriends, a popular dating app, have surfaced on a prominent deep web hacking forum, according to researchers. MobiFriends is an online service and Android app designed to help users worldwide meet new people online. The Barcelona-based developer of...

CVE-2020-3921

The CVE-2020-3921 entry concerns Unisoon UltraLog Express device management software that stores user information in cleartext, enabling access to account data via a specific page. Multiple connected sources corroborate: the vulnerability is a data disclosure due to plaintext storage in the Ultra...

Sql injection

Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA...

CVE-2018-11768

CVE-2018-11768 affects Apache Hadoop versions: 3.1.0–3.1.1, 3.0.0-alpha1–3.0.3, 2.9.0–2.9.1, and 2.0.0-alpha–2.8.4. The vulnerability is caused by a mismatch in the size of the fields used to store user/group information between memory and disk representations in fsimage, allowing a remote attack...

Design/Logic Flaw

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGINID element to the auth/main/asp/checkuserlogininfo.aspx URI, and then reading the response, as demonstrated by the KWEMAIL or KWTEL field...

CVE-2019-11233

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGINID element to the auth/main/asp/checkuserlogininfo.aspx URI, and then reading the response, as demonstrated by the KWEMAIL or KWTEL field...

WESEEK GROWI Cross-Site Request Forgery Vulnerability

WESEEK GROWI is a suite of team collaboration software from WESEEK Japan. A cross-site request forgery vulnerability exists in the process of updating a user's basic information in WESEEK GROWI 3.4.6 and prior versions. The vulnerability stems from the WEB application not adequately verifying tha...

Malicious Package

Overview All versions of requuest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Malicious Package

Overview All versions of exprss typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Aussie govt emergency service hacked to send fake warning alerts

By Waqas A hacker managed to infiltrate Australian emergency warning system Early Warning Network EWN. The hacker accessed the system and sent countless messages to random citizens informing them that “you’ve been hacked.” However, the warning service’s managing director Kerry Plowright claims th...