CVE-2024-2472

CVE-2024-2472 relates to the LatePoint WordPress plugin. Public details confirm a Missing Authorization vulnerability via IDOR in all versions ≤ 4.9.9, enabling unauthenticated attackers to view other customers’ cabinets, access PII (e.g., emails), and change a user’s LatePoint password. The root...

CVE-2024-37364

Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information such as hotel invoice content with PII, and potentially create unauthorized room keys, by entering a guest-search quote character and then...

CVE-2024-37364

The CVE-2024-37364 entry concerns Ariane Allegro Scenario Player (through 2024-03-05) with Ariane Duo kiosk mode. A physically proximate attacker can access sensitive information (e.g., hotel invoices with PII) and potentially create unauthorized room keys by entering a guest-search quote charact...

CVE-2024-37364

Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information such as hotel invoice content with PII, and potentially create unauthorized room keys, by entering a guest-search quote character and then...

CVE-2024-36049

Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and passwords from the database server, using an unencrypted connection. This allows attackers in a machine-in-the-middle position read and write access to personal...

CVE-2024-36049

Aptos Wisal Payroll Accounting prior to version 7.1.6 is affected by a vulnerability where the Windows client uses hardcoded credentials to fetch the full list of usernames and passwords from the database over an unencrypted connection. This enables a machine-in-the-middle attacker to read and wr...

CVE-2024-4213

CVE-2024-4213 concerns the WordPress plugin Shopping Cart & eCommerce Store (WP-EasyCart). The vulnerability is a case of Sensitive Information Exposure via the plugin’s order report functionality in all versions up to 5.6.4, allowing unauthenticated attackers to extract order details and other P...

CVE-2024-4213 Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive data including order details such as...

CVE-2023-6214

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchasedproducts function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7...

CVE-2023-6214 HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_products

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.6 via the purchasedproducts function. This makes it possible for unauthenticatied attackers to extract sensitive data including the previous 7...

CVE-2024-32726 WordPress Frontend Dashboard plugin <= 2.2.2 - Sensitive Data Exposure on PII vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a through 2.2.2...

CVE-2024-32726 WordPress Frontend Dashboard plugin <= 2.2.2 - Sensitive Data Exposure on PII vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in vinoth06. Frontend Dashboard.This issue affects Frontend Dashboard: from n/a through 2.2.2...

HT Mega < 2.4.7 - Unauthenticated Order Data Disclosure

Description The plugin is vulnerable to Sensitive Information Exposure via the purchasedproducts function, allowing unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII...

How to check if your data was exposed in the AT&#038;T breach

AT&T has notified US state authorities and regulators about its recent or not data breach, saying 51,226,382 people were affected. For those that have missed the story so far: Back in 2021, a hacker named Shiny Hunters claimed to have breached AT&T. On March 20, 2024, we reported how the data of...

CVE-2024-2302

The Easy Digital Downloads – Sell Digital Files & Subscriptions eCommerce Store + Payments Made Easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via...

CVE-2024-2302 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure

The Easy Digital Downloads – Sell Digital Files & Subscriptions eCommerce Store + Payments Made Easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the debug log via...

CVE-2024-2302

The CVE-2024-2302 entry concerns Easy Digital Downloads – Sell Digital Files & Subscriptions for WordPress. It describes an Information Disclosure vulnerability in all versions up to 3.2.9, allowing unauthenticated attackers to download the plugin’s debug log via Directory Listing, potentially ex...

Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) < 3.2.10 - Sensitive Information Exposure

Description The Easy Digital Downloads – Sell Digital Files & Subscriptions eCommerce Store + Payments Made Easy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible for unauthenticated attackers to download the...

19 million plaintext passwords exposed by incorrectly configured Firebase instances

Three researchers scanned the internet for vulnerable Firebase instances, looking for personally identifiable information PII. Firebase is a platform for hosting databases, cloud computing, and app development. Its owned by Google and was set up to help developers build and ship apps. What the...

HackerOne: Possible PII Disclosure via Advanced Vetting Process - ██████

Possible PII disclosure was identified in the HackerOne Advanced Vetting process. Unauthorized users were able to download a CSV file containing the names, usernames, and other personal details of users who had accepted the Advanced Vetting terms. The issue was observed in a sandboxed program, bu...