CVE-2022-48364

Summary: CVE-2022-48364 affects Mastodon 3.5.x before 3.5.3. The vulnerability resides in the undo_mark_statuses_as_sensitive method of app/services/approve_appeal_service.rb, which does not use the server’s representative account, causing moderator identity disclosure when a moderator approves a...

The vulnerability of the Jenkins Repository Connector Plugin, related to deficiencies in the authentication process, allows attackers to disclose information about user identities.

The vulnerability of the Jenkins Repository Connector Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to obtain information about user identities remotely...

Recovering Real Faces from Face-Generation ML System

New paper: "This Person Probably Exists. Identity Membership Attacks Against GAN Generated Faces. Abstract: Recently, generative adversarial networks GANs have achieved stunning realism, fooling even human observers. Indeed, the popular tongue-in-cheek website http://thispersondoesnotexist.com,...

Bumble: Ability to collect users' ids that have visited a specific web page with malicious code

Hey , Regarding this report 130453 , I'm pretty sure that there's a little misunderstanding of the issue , so please let me clarify the issue a bit more . The issue is not about the disclosure of user's id , that wouldn't be considered an issue at all because every website puts user's id in the...

PYSEC-2009-17

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors...