PT-2022-22321 · Tabit · Tabit

Name of the Vulnerable Software and Affected Versions: Tabit affected versions not specified Description: The issue concerns the disclosure of sensitive information through several APIs on the Tabit web system. These APIs display health statements, previous bills, alcohol consumption, and smoking...

WordPress WP Server Health Stats plugin <= 1.6.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Mika in WordPress WP Server Health Stats plugin versions = 1.6.10. Solution Update the WordPress WP Server Health Stats plugin to the latest available version at least 1.7.0...

WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC As admin, put the following payload in the "Provide your IP-API Pro key", "Memcached Server Host", "Set the...

WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. As admin, put the following payload in the "Provide your IP-API Pro key", "Memcached Server Host", "Set the realti...

GTAB Software Tabit 信息泄露漏洞

GTAB Software Tabit is a full-featured program from GTAB Software for creating, playing and printing fingerstyle scores for guitar, bass or banjo. GTAB Software Tabit suffers from an information disclosure vulnerability that stems from several APIs on its web system displaying unauthorized...

CVE-2022-34776

Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its URL one or more MongoDB ID which is not...

CVE-2022-34770

Tabit - sensitive information disclosure. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described API’s, has in its URL one or more MongoD...

Andariel deploys DTrack and Maui ransomware

On July 7, 2022, the CISA published an alert, entitled, "North Korean State-Sponsored Cyber Actors Use Maui Ransomware To Target the Healthcare and Public Health Sector," related to a Stairwell report, "Maui Ransomware." Later, the Department of Justice announced that they had effectively clawed...

0xCC'd

We spend a lot of time preparing for Blackhat, and as part of putting together content for the show, one of our best, Lurene Grenier, submitted an unexpected piece of content: a poem. Now this poem isn't our regular security research or a shiny piece of corporate correspondence which we would nev...

F5 BIG-IP 注入漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An elevation of privilege vulnerability exists in the F5 BIG-IP health check configuration, which can be exploited by an...

National Health Insurance 缓冲区错误漏洞

National Health Insurance NHI is a health insurance program health insurance card in Taiwan, China. A security vulnerability exists in National Health Insurance that stems from insufficient validation of network packet header lengths and a stack-based buffer overflow, which could be exploited by ...

National Health Insurance 安全漏洞

National Health Insurance NHI is a health insurance program health insurance card in Taiwan, China. A security vulnerability exists in National Health Insurance that stems from insufficient validation of network packet header lengths and a stack-based buffer overflow, which could be exploited by ...

The vulnerability of Becton Dickinson’s Pyxis medication and supplies management solutions lies in the insufficient protection of registration data, allowing unauthorized access to electronic protected medical information (ePHI).

The vulnerability of Becton Dickinson’s Pyxis software for managing medications and related supplies is related to insufficient protection of registration data. Exploiting this vulnerability could allow an intruder to gain unauthorized access to electronically protected medical information...

Have we lost the fight for data privacy? Lock and Code S03E16

At the end of 2021, Lock and Code invited the folks behind our news-driven cybersecurity and online privacy blog, Malwarebytes Labs, to discuss what upset them most about cybersecurity in the year prior. Today, were bringing those same guests back to discuss the other, biggest topic in this space...

Multi-image Analysis GUI 安全漏洞

Multi-image Analysis GUI Mango is a viewer of medical research images organized by the University of Texas Health Science Center. A security vulnerability in University of Texas Health Science Center Multi-image Analysis GUI version 4.1, which stems from an issue in RoamingMangoPlugins allows...

Don’t Call the New Federal Gun Law a Gun Law

Democratic senators lacked actionable gun data for their negotiations—so they passed mental health reform instead...

CVE-2022-21518

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications component: User Interface. Supported versions that are affected are 2.4.8.7 and 2.5.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

CVE-2022-21518

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications component: User Interface. Supported versions that are affected are 2.4.8.7 and 2.5.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

CVE-2022-21518

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications component: User Interface. Supported versions that are affected are 2.4.8.7 and 2.5.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

Design/Logic Flaw

Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications component: User Interface. Supported versions that are affected are 2.4.8.7 and 2.5.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...