Design/Logic Flaw

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email...

CVE-2018-1000803

The CVE refers to Gitea prior to v1.5.1, where a CWE-200 information-disclosure flaw allows exposure of users’ private email addresses. According to connected sources, the issue can be triggered via the “Watch a repository” email-notification flow, causing emails to include recipients’ addresses ...

Khan Academy: Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeovers

Summary The /signup/email API endpoint at khanacademy.org is vulnerable to Cross-Site Request Forgery CSRF attacks, allowing takeovers of accounts associated with unconfirmed email addresses. Description The vulnerable endpoint allows an authenticated user to change the email address associated...

The Apollo Breach Included Billions of Data Points

Sales intelligence firm Apollo left a "staggering amount" of exposed online, including 125 million email addresses and nine billion data points...

SHEIN-Fashion Shopping Site Suffers Data Breach Affecting 6.5 Million Users

U.S. online fashion retailer SHEIN has admitted that the company has suffered a significant data breach after unknown hackers stole personally identifiable information PII of almost 6.5 million customers. Based in North Brunswick and founded in 2008, SHEIN has become one of the largest online...

Partnerstroka: Large tech support scam operation features latest browser locker

Tech support scams continue to be one of the top consumer threats in 2018, despite actions from security vendors and law enforcement. Scammers are constantly looking for new ways to reel in more victims, going beyond cold calls impersonating Microsoft to rogue tech support ads using the good name...

Atlassian JIRA ProfileLinkUserFormat Information Disclosure Vulnerability

The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and from version 7.11.0 before version 7.11.2 allows remote...

Office 365 User Enumeration

Enumerate valid usernames email addresses from Office 365 using ActiveSync. Differences in the HTTP Response code and HTTP Headers can be used to differentiate between: - Valid Username Response code 401 - Valid Username and Password without 2FA Response Code 200 - Valid Username and Password wit...

Atlassian JIRA Server ProfileLinkUserFormat Component Information Disclosure Vulnerability

Atlassian JIRA Server is a defect tracking management system from Atlassian Australia. The system is used to track and manage all kinds of issues and defects in the workplace.ProfileLinkUserFormat is one of the user information display components. An information disclosure vulnerability exists in...

Brazilian Crypto exchange hacked; private data of over 264,000 users exposed

By Waqas A Brazilian firm Crypto exchange Atlas has become a victim of a security breach and over 264,000 users’ email addresses, phone numbers, and cryptocurrency amount related information might have been leaked. The news of data hack was reported firstly by a YouTube channel in Brazil called...

CVE-2018-13391

The CVE-2018-13391 issue affects Atlassian Jira Server across multiple versions, enabling remote attackers who can access and view an issue to obtain the reporter’s and assignee’s email addresses even when email visibility is configured to hidden. Affected ranges are: Jira Server before 7.6.8; 7....

CVE-2017-2654

jenkins-email-ext before version 2.57.1 is vulnerable to an Information Exposure. The Email Extension Plugins is able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emai...

Information disclosure

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in ra...

CVE-2017-2651

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in ra...

Identity theft protection firm LifeLock may have exposed user email addresses

By Waqas LifeLock, an Arizona-based identity theft protection firm may have exposed email addresses of millions of its customers - Simply put: A firm vowing to protect online identity of its customers may have exposed their identity to malicious hackers and cybercriminals. It happened due to a...

Lenovo Help Android app information disclosure vulnerability

Lenovo Help Android app is a Chinese Lenovo Lenovo application that provides online support for Lenovo products such as computers, cell phones and data centers. The app is mainly used to check device information and warranty status of Lenovo products, etc. A security vulnerability exists in the...

Improper access control

The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure of approximately 400 email addresses and 8,500 IMEI...

CVE-2018-9067

The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure of approximately 400 email addresses and 8,500 IMEI...