Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure which allows an attacker to determine the existence of user accounts by analyzing the response times and codes. Remediation Upgrade Umbraco.Cms.Core to version 14.3.2, 15.1.2 or higher. References - GitHub Commit -...

CVE-2024-45647

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password...

Russian Star Blizzard Targets WhatsApp Accounts in New Spear-Phishing Campaign

The Russian threat actor known as Star Blizzard has been linked to a new spear-phishing campaign that targets victims' WhatsApp accounts, signaling a departure from its longstanding tradecraft in a likely attempt to evade detection. "Star Blizzard's targets are most commonly related to government...

CVE-2025-0456 NetVision Information airPASS - Missing Authentication

The airPASS from NetVision Information has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access the specific administrative functionality to retrieve all accounts and passwords...

CVE-2025-0456

The CVE-2025-0456 issue concerns the airPASS product from NetVision Information. The root cause is a Missing Authentication vulnerability that allows unauthenticated remote attackers to access an administrative function and retrieve all accounts and passwords. The connected sources provide high-s...

NetVision Information airPASS 访问控制错误漏洞

NetVision Information airPASS is an application from China's Zhengbang Information NetVision Information. An access control error vulnerability exists in NetVision Information airPASS that stems from a lack of authentication vulnerability that could allow an unauthenticated, remote attacker to...

Exploit for Cross-Site Request Forgery (CSRF) in Oretnom23 Packers_And_Movers_Management_System

CVE-2024-57523 - CSRF Vulnerability in Users.php - SourceCodes...

The great Google Ads heist: criminals ransack advertiser accounts via fake Google ads

Table of contents Overview Criminals impersonate Google Ads Lures hosted on Google Sites Phishing for Google account credentials Victimology Who is behind these campaigns? Fuel for other malware and scam campaigns Indicators of Compromise Overview Online criminals are targeting individuals and...

Microsoft Takes Legal Action Against AI “Hacking as a Service” Scheme

Not sure this will matter in the end, but it's a positive move: Microsoft is accusing three individuals of running a "hacking-as-a-service" scheme that was designed to allow the creation of harmful and illicit content using the company's platform for AI-generated content. The foreign-based...

Stripo Inc: [my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier

A critical Blind SSRF Server-Side Request Forgery vulnerability was identified in the export service of the Stripo app. The vulnerability existed in the endpoint /exportservice/v3/exports/WEBHOOK/accounts, where malicious input could be provided in the webhookUrl parameter, triggering SSRF and...

CVE-2024-4166

creationtimestamp| type| source ---|---|--- 2025-01-05 01:32:44+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/55 2025-01-05 01:35:24+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/77 2025-01-05 01:38:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/99...

TikTok: Unauthorized Access to Private Video Description via Translation API for Private Accounts

A vulnerability was discovered in the TikTok translation API endpoint that could have allowed unauthorized access to video descriptions contained in private accounts...

CVE-2025-22385

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...

CVE-2025-22385

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...

Optimizely Configured Commerce 安全漏洞

Optimizely Configured Commerce is a portfolio commerce platform from Optimizely, Inc. A security vulnerability exists in Optimizely Configured Commerce versions prior to 5.2.2408, which stems from an email confirmation not being required for newly created accounts...

CVE-2025-22385

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested...

ZenML < 0.56.2 Vulnerability - CVE-2024-2035

The version of ZenML installed on the remote host is prior to 0.56.2. It is, therefore, affected by An improper authorization vulnerability exists in the API /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing th...

Quanta Computer QOCA aim 安全漏洞

Quanta Computer QOCA aim is an AI-assisted medical imaging and automated reasoning platform from Quanta Computer China. A security vulnerability exists in Quanta Computer QOCA aim that stems from an authorization bypass user control key vulnerability that allows a remote attacker with regular...

SimplCommerce 安全漏洞

SimplCommerce is SimplCommerce open source a simple, cross-platform, modular e-commerce system built on . A security vulnerability exists in SimplCommerce. An attacker could exploit the vulnerability to bypass inventory limits and submit simultaneous purchase requests for the same product from...

CVE-2024-11281

The WooCommerce Point of Sale plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0. This is due to insufficient validation on the 'loggedinuserid' value when option values are empty and the ability for attackers to change the email of arbitrary us...