CVE-2019-16907

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI...

Design/Logic Flaw

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI...

Authentication flaw

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no...

CVE-2019-16907

CVE-2019-16907 affects Infosysta In-App & Desktop Notification for Jira (version 1.6.13_J8). The vulnerability enables an unauthenticated/user-discovery disclosure: an attacker can obtain a list of valid Jira usernames through the URL plugins/servlet/nfj/UserFilter?searchQuery=@ without authoriza...

CVE-2019-16906

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no...

CVE-2019-16906

CVE-2019-16906 concerns Infosysta In-App & Desktop Notifications for Jira (v1.6.13_J8). Affected component is the PushNotification functionality exposed via plugins/servlet/nfj/PushNotification?username=, allowing an attacker to read another user’s notifications without authentication/authorizati...

WordPress YITH Desktop Notifications for WooCommerce plugin <=1.2.7 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH Desktop Notifications for WooCommerce plugin versions =1.2.7. Solution Update the WordPress YITH Desktop Notifications for WooCommerce plugin to the latest available version at leas...

PT-2019-14857

Name of the Vulnerable Software and Affected Versions Infosysta In-App & Desktop Notifications app version 1.6.13 J8 for Jira Description An issue in the Infosysta In-App & Desktop Notifications app allows unauthorized access to a different user's notifications. This can be achieved by modifying...

CVE-2019-16907: Missing Authentication for Critical Function

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13J8 for Jira. It is possible to obtain a list of all valid Jira usernames without authentication/authorization via the plugins/servlet/nfj/UserFilter?searchQuery=@ URI...

CVE-2019-16906: Missing Authentication for Critical Function

An issue was discovered in the Infosysta "In-App & Desktop Notifications" app 1.6.13J8 for Jira. By using plugins/servlet/nfj/PushNotification?username= with a modified username, a different user's notifications can be read without authentication/authorization. These notifications are then no...

PT-2019-14858

Name of the Vulnerable Software and Affected Versions Infosysta In-App & Desktop Notifications app version 1.6.13 J8 for Jira Description An issue in the Infosysta In-App & Desktop Notifications app allows obtaining a list of all valid Jira usernames without authentication or authorization. This...

chromium-browser: Full screen notification overlap

UI spoofing in Chromium in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof notifications via a crafted HTML page...

Google Chrome Forgery Vulnerability (CNVD-2019-38234)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in Google Chrome versions prior to 78.0.3904.70, which stems from the program not properly handling browser notifications. The vulnerability can be exploited by an attacker to spoof the content of a...

UniCredit Bank Suffers 'Data Incident' Exposing 3 Million Italian Customer Records

UniCredit, an Italian global banking and financial services company, announced today that it suffered a security incident that leaked some personal information belonging to at least 3 million of its domestic customers. Officially founded in 1870, UniCredit is Italy's biggest banking and financial...

Experts on demand: Your direct line to Microsoft security insight, guidance, and expertise

Microsoft Threat Experts is the managed threat hunting service within Microsoft Defender Advanced Threat Protection ATP that includes two capabilities: targeted attack notifications and experts on demand. Today, we are extremely excited to share that experts on demand is now generally available a...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Python security vulnerability (CVE-2019-10160)

Summary IBM Cloud Kubernetes Service is vulnerable to CVE-2019-10160 Python security vulnerability which could allow a remote attacker to obtain sensitive information, caused by improper unicode encoding handling. Vulnerability Details CVE-ID: CVE-2019-10160 Description: Python...

Design/Logic Flaw

The Easy Digital Downloads EDD Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9521

The Easy Digital Downloads EDD Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2015-9521

The CVE-2015-9521 issue affects the Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress. The vulnerability is an XSS flaw caused by misusing add_query_arg, affecting EDD versions: 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x befor...

CVE-2015-9521: Improper Neutralization of Input During Web Page Generation

The Easy Digital Downloads EDD Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...