Umbraco Security Breach

Umbraco is an open source content management system CMS written in C from Umbraco, Denmark. A security vulnerability exists in Umbraco that originates from a backend user with package creation privileges who can use path traversal to write outside of the expected location...

CVE-2023-49805

Uptime Kuma prior to version 1.23.9 is vulnerable to missing origin validation in Socket.IO WebSocket connections. The server does not verify the Origin header, allowing cross-origin access from third-party sites and potential exposure of sensitive data in protected endpoints, even without user i...

Teleport: access list owner can escalate his role to the highest roles

Summary: 1. Go to your-domain.teleport.sh/web/accesslists. 2. Create a new access list and add a role to "Roles Granted," e.g., "reviewer" role. 3. Add a user as the Access List Owner. 4. The user, as the Access List Owner, can escalate the role of the list to higher roles, thereby escalating the...

A week in security (December 4 – December 10)

Last week on Malwarebytes Labs: Meta’s Purple Llama wants to test safety risks in AI models US government is snooping on people via phone push notifications, says senator Android phones can be taken over remotely – update when you can How IT teams can conduct a vulnerability assessment for...

MonicaHQ Security Breach

MonicaHQ is a relationship management system from MonicaHQ, Inc. A security vulnerability exists in MonicaHQ version 4.0.0. An attacker can exploit this vulnerability to upload SVG documents that contain cross-site scripting vulnerabilities...

Google Chromecast Security Breach

Google Chromecast is a technology from the American company Google Google. It allows you to stream your favorite entertainment and apps from your phone, tablet or laptop directly to your TV or speakers. Google Chromecast has a security vulnerability that stems from the presence of a code executio...

Google Chromecast Security Breach

Google Chromecast is a technology from the American company Google Google. It allows you to stream your favorite entertainment and apps from your phone, tablet or laptop directly to your TV or speakers. Google Chromecast has a security vulnerability that stems from the presence of an elevation of...

Google Chromecast Security Breach

Google Chromecast is a technology from the American company Google Google. It allows you to stream your favorite entertainment and apps from your phone, tablet or laptop directly to your TV or speakers. Google Chromecast has a security vulnerability that stems from a security flaw in BCB that...

IzyBat Orange casiers security breach

IzyBat Orange casiers is a website. A security vulnerability exists in versions prior to IzyBat Orange casiers 202308031, which stems from allowing SQL injection via getEnsemble.php ensemble...

nuovadecoritalia.com Improper Access Control vulnerability OBB-3806508

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

EverShop Security Breach

EverShop is EverShop open source a NodeJS e-commerce platform. A security vulnerability exists in EverShop versions prior to v.1.0.0-rc.8. A remote attacker can use this vulnerability to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file...

EverShop Security Breach

EverShop is EverShop open source a NodeJS e-commerce platform. A security vulnerability exists in EverShop versions prior to 1.0.0-rc.5 that stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability, which allows attackers to inject malicious code into the application's admin...

Collabora Online Security Breach

Collabora Online is an application from Collabora UK. A powerful LibreOffice-based online office that supports all major document, spreadsheet and presentation file formats. A security vulnerability exists in Collabora Online versions prior to 23.5.602 that stems from vulnerability to modified...

Google Pixel Security Breach

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from the presence of a logic error in the code, where the modem may experience a denial of service...

EverShop Security Breach

EverShop is EverShop open source a NodeJS e-commerce platform. A security vulnerability exists in versions prior to EverShop v.1.0.0-rc.8. A remote attacker could exploit the vulnerability to obtain sensitive information via a specially crafted request for the sortBy parameter...

Google Pixel Security Breach

Google Pixel is a smartphone from the American company Google. Google Pixel has a security vulnerability that stems from the presence of a logic error in the code...

Hacker IntelBroker Leaks Alleged Sensitive US DoD Documents

By Waqas The documents were leaked on December 6th, 2023, on Breach Forums. This is a post from HackRead.com Read the original post: Hacker IntelBroker Leaks Alleged Sensitive US DoD Documents...

PT-2023-9582 · Oracle · Peoplesoft Enterprise Peopletools

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise PeopleTools versions 8.59 through 8.61 Description: The issue is related to insufficient input validation in the XMLPublisher component, allowing a low-privileged attacker with network access via HTTP to compromise...

Devolutions Workspace Security Breach

Devolutions Workspace is a mobile and desktop application from Devolutions Canada. A security vulnerability exists in Devolutions Workspace version 2023.3.2.0 and earlier, which stems from the fact that an attacker with privileged access to the Workspace application can access credentials while...

Insyde InsydeH2O Security Breach

Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. Insyde A security vulnerability exists in InsydeH2O, which stems from a LogoFAIL issue in BmpDecoderDx...