Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users...

SQL Injection Vulnerability in the de***.aspx Page of CrowdSoft Web Application System

CrowdSoft is an independent and innovative software enterprise providing informationization services for government and enterprises and institutions. A SQL injection vulnerability exists in the de.aspx page of the CrowdSmart Software Web application system, which can be exploited by attackers to...

Exposed suppressed username or log in Special:EditTags

More info at https://phabricator.wikimedia.org/T222036...

The vulnerability of Docker images of Oracle WebLogic Server application servers allows a hacker to gain access to protected information.

The vulnerability of Oracle WebLogic Server application server Docker images is related to insufficient access control. Exploiting this vulnerability could allow an attacker to gain access to protected information using the T3 protocol...

Threatpost News Wrap Podcast For Jan. 18

Exposed personal data seemed to be the big trend this week, which was overshadowed by Troy Hunt’s discovery of a database of breached emails totaling 773 million unique addresses in a popular cloud service. Millions of sensitive files on a storage server belonging to the Oklahoma Department of...

Google+ to Shut Down Early After New API Flaw Hits 52.5 Million Users

Google today revealed that Google+ has suffered another massive data breach, forcing the tech giant to shut down its struggling social network four months earlier than its actual scheduled date, i.e., in April 2019 instead of August 2019. Google said it discovered another critical security...

Private data of more than 82 million US citizens left exposed

By Uzair Amir Misconfigured ElasticSearch Servers Exposed Private Data of over 82 Million Users. A warning has been issued by Bob Diachenko, a HackenProof security researcher informing users in the US that around 73 gigabytes of data is identified in a “regular security audit” of publicly...

A Dunkin' Donuts Hack, a Fake FedEx Site, and More Security News This Week

Scam centers, exposed massage company data, and more of the week's top security news...

Ansible Information Disclosure Vulnerability (CNVD-2018-12556)

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. A security vulnerability exists in Ansible version 2.5 before 2.5.5 and version 2.4 before 2.4.5. An attacker can exploit the vulnerability to expose sensiti...

A cryptocurrency platform exposed sensitive data of 25,000 users

By Waqas Bezop, a cryptocurrency startup exposed highly personal details of more This is a post from HackRead.com Read the original post: A cryptocurrency platform exposed sensitive data of 25,000 users...

DEBIAN-CVE-2015-2156

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name a...

CVE-2017-14349

An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and monitors, potentially exposing sensitive data...

Meeting and Hotel Booking Provider's Data Found in Public Amazon S3 Bucket

Leaks of personal and business information from unsecured Amazon S3 buckets are piling up. The latest belongs to Groupize, a Boston-area business that sells tools to manage small group meetings as well as a booking engine that handles hotel room-block reservations. Researchers at Kromtech Securit...

Fusion Router App for Android suffers from an overstepping access vulnerability

Fusion Router APP is a mobile network management tool for cell phones. The software works with Fusion Router to remotely view and manage the router, as well as set the internet time. Fusion Router APP for Android suffers from an overstepping access vulnerability, which can be exploited by an...

SQL Injection Vulnerability in Nanjing Nanda Shangcheng Content Management System CountArticle.jsp Page

Nanjing Nanda Shangcheng content management system is a smart government solution. A SQL injection vulnerability exists in the CountArticle.jsp page of the Nanjing Nanda Shangcheng Content Management System. The lack of filtering of the 'ID' parameter allows an attacker to exploit the vulnerabili...

Printing and Marketing Firm Leaks High-Profile Customers' Data

Franchise Services, the parent company of a number of large print and design companies, said it is investigating claims that sensitive customer data stored by one of its franchisees is accessible online. The data dates back to 2010 and ranges from sensitive health records belonging to a former...

Nextcloud: nextcloud.com: Directory listening for 'wp-includes' forders

Hello guys, Details: The web server is configured to display the list of files contained in this directory. As a result of a misconfiguration - end user / attacker able to see content of the folders with systemically important files Vulnerable place: /wp-includes directory when I tried to navigat...

Android Factory Reset Improper Sanitization Exposes Data

The churn of Android devices, whether older smartphones being traded in or sold online, makes device sanitization imperative. The native feature in the OS, however, may not be doing as thorough a job as advertised. A paper, “Security Analysis of Android Factory Resets” pdf, published by Ross...

Vulnerabilities of the Debian GNU/Linux operating system, which allow a remote attacker to compromise the integrity and accessibility of protected information

The multiple vulnerabilities in the libssl0.9.7-dbg package of the Debian GNU/Linux operating system may lead to a violation of the integrity and accessibility of protected information. These vulnerabilities can be exploited remotely...

JustHost Hosting Server Compromised, More than 1000's of websites at Risk !

JustHost Hosting Server Compromised, More than1000's of websites at Risk ! JustHost.com Server Breached ! "Just host is one of the fast growing hosting industries with the good uptime reliability with the best support and it's new to the world wide in the year 2008.Just host .com is one of the...