Some Meta Employees and Security Guards Hacked User Accounts

By Deeba Ahmed The fired individuals included on-contract security guards who worked for Meta and could access an internal tool for employees. This is a post from HackRead.com Read the original post: Some Meta Employees and Security Guards Hacked User Accounts...

Vulnerability fixed in Atlassian Confluence

Atlassian has fixed a vulnerability in Confluence. A malicious party could exploit the vulnerability to break into publicly accessible Confluence Data Center and Server instances, create unauthorized Confluence administrator accounts and gain access to Confluence instances. Atlassian has released...

Atlassian Confluence Data Center and Server Broken Access Control Vulnerability

Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence...

CVE-2023-22515

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access...

CVE-2023-22515

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access...

Design/Logic Flaw

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access...

CVE-2023-40519

A cross-site scripting XSS vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00.19219575ee9195b0, 01.01.01.30097902fd999e76, and 00.12.01.95655881254b459 allows remote attackers to inject arbitrary web script or HTML v...

CVE-2023-40519

A cross-site scripting XSS vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00.19219575ee9195b0, 01.01.01.30097902fd999e76, and 00.12.01.95655881254b459 allows remote attackers to inject arbitrary web script or HTML v...

CVE-2023-32791

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

CVE-2023-32791 Cross-Site Request Forgery on NXLog Manager

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

CVE-2023-32791

NXLog Manager is affected by a CSRF vulnerability in version 5.6.5633. The issue arises from insufficient validation of request origin, enabling a remote attacker to manipulate and delete user accounts by sending a crafted query to the server. The CVE record lists a CVSS v3.1 base score of 6.5 (M...

CVE-2023-32791 Cross-Site Request Forgery on NXLog Manager

Cross-Site Request Forgery CSRF vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is based on the lack of proper validation of t...

cashIT Security Breach

cashIT is an old cell phone recycling website by cashIT India. cashIT suffers from a security vulnerability that stems from a database disclosure system settings, user accounts, etc. that can be triggered via HTTP endpoints exposed to the network...

CVE-2023-40519

CVE-2023-40519 describes a cross-site scripting (XSS) vulnerability in the Broadpeak Centralized Accounts Management Auth Agent, specifically the login portal at bpk-common/auth/login/index.html. The issue can be triggered by a malicious value in the disconnectMessage parameter, enabling remote a...

CVE-2023-40519

A cross-site scripting XSS vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management Auth Agent 01.01.00.19219575ee9195b0, 01.01.01.30097902fd999e76, and 00.12.01.95655881254b459 allows remote attackers to inject arbitrary web script or HTML v...

Nxlog 跨站请求伪造漏洞

NXLog Manager is a solution that can be used from a browser to easily manage and monitor a large number of NXLog Enterprise instances. NXLog Manager suffers from a cross-site request forgery vulnerability that can be exploited by a remote attacker to submit a specially crafted malicious request...

Application allows excessively long password value

Description Vrite v0.2.0 allows excessively long passwords to be set for user accounts which introduce several issues and challenges, primarily related to performance, storage, and compatibility. Proof of Concept 1. Make an user profile in the app. 2. Go to settings security Change password. 3. I...

OESA-2023-1687 shadow security update

This package includes the necessary programs for converting plain password files to the shadow password format and to manage user and group accounts. Security Fixes: When gpasswd1 asks for the new password, it asks twice as is usual for confirming the new password. Each of those 2 password prompt...

UBUNTU-CVE-2023-41324

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user that have read access on users resource can steal accounts of other users. Users are advised t...