CVE-2021-41849

The CVE-2021-41849 entry concerns Luna Simo PPR1.180610.011/202001031830, where PII (installed apps list, IMEI) is transmitted in plaintext over HTTP to log.skyroam.com.cn, independent of Simo usage. This is documented across multiple sources (NVD/Red Hat PRION/PR-ION PT-Security) and confirmed b...

PT-2022-11500 · Luna Simo · Luna Simo

Name of the Vulnerable Software and Affected Versions: Luna Simo PPR1.180610.011/202001031830 Description: An issue was discovered in Luna Simo where it sends Personally Identifiable Information PII in plaintext using HTTP to servers located in China. The PII includes the user's list of installed...

Information disclosure

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednaosmartformsentrieslist AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form...

CVE-2022-0163 Smart Forms < 2.6.71 - Subscriber+ Form Data Download

The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednaosmartformsentrieslist AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form...

Entering a Higher State of Vigilance – Ukraine Under Attack

It appears that Russia has just commenced the invasion of Ukraine. Check your preferred international news outlet, but according to the Ukrainian foreign minister "Putin has just launched a full-scale invasion of Ukraine." Ukrainian airspace is closed with flights diverting. The Twitter Safety...

U.S. Dept Of Defense: Authorization bypass -> IDOR -> PII Leakage

Hi team! During testing ████ I found javascript file containing administrative panel functionality. It is accessible at: https://████/█████████ In this file I found an end point responsible for returning data about applications of the website users to the website administrators. The returned data...

U.S. General Services Administration: Account takeover leading to PII chained with stored XSS

I have found a vulnerability on https://vehiclestdb.fas.gsa.gov/ for account takeovers The website is not using proper authentication to claim the user signing in is actually the account owner due to only requiring an email address to sign in and no password. This leads to an attacker being able ...

Smart Forms < 2.6.71 - Subscriber+ Form Data Download

The plugin does not have authorisation in its rednaosmartformsentrieslist AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form. PoC Execute the below command in the web...

CVE-2022-22765

BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information ePHI, protected health information PHI and personally identifiable information...

Hardcoded credentials

BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information ePHI, protected health information PHI and personally identifiable information...

CVE-2022-22765

BD Viper LT system (BD) is affected for all versions 2.0 and later due to use of hard-coded credentials (CWE-798). The ICS advisory icsma-22-062-02 documents that an attacker could access, modify, or delete ePHI, PHI, and PII. The 4.0+ Windows 10 hardening in newer releases raises attack complexi...

CVE-2022-22765 BD Viper LT System - Hardcoded Credentials

BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information ePHI, protected health information PHI and personally identifiable information...

The Big Target on Cyber Insurers' Backs

Here at IntSights, a Rapid7 company, our goal is to equip organizations around the world with an understanding of the threats facing them in today's cyber threat landscape. Most recently, we took a focused look at the insurance industry — a highly targeted vertical due to the amount of personally...

Securitas breached, 3TB of airport employee records exposed

An unsecured AWS server, found open to the public Internet, is the root cause of a huge compromise of data of airport employees in Colombia and Peru. This server, according to a report, belongs to Securitas, a Stockholm-based multinational company that provides security services like security...

DPD package sniffing

TL;DR An unauthenticated API call was identified in DPD Group’s public API that could allow a user with a valid package ID to, with some basic OSINT, discover the package’s destination postcode and thus obtain all details about the package. DPD Group were prompt in the triage and resolution of th...

Cyberattackers Hit Data of 80K Patients at Fertility Centers of Illinois

The protected health information of nearly 80,000 patients of Fertility Centers of Illinois FCI may have been pawed over by cyber intruders following a cyberattack. FCI runs four clinics across Illinois. According to the U.S. Department of Health and Human Services HHS Office for Civil Rights’ da...

Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber

Description Any unauthorized/unauthenticated actor can find the PII data of all the users registered in the application. PII - Personally Identifiable Information leaked by this application is first name, last name, email id, picture, username, isadmin status Proof of Concept 1 Visit...

Facebook to Pay Hackers for Reporting Data Scraping Bugs and Scraped Datasets

Meta Platforms, the company formerly known as Facebook, has announced that it's expanding its bug bounty program to start rewarding valid reports of scraping vulnerabilities across its platforms as well as include reports of scraping data sets that are available online. "We know that automated...

Gumtree – leaking your data and not really listening

Sometimes finding vulnerabilities is as simple as… just looking. TL;DR 1. Gumtree is a UK-based site where users can advertise items for sale. 2. It leaked the PII of sellers to other users of the site within the HTML source of the adverts. Email address, postcode, GPS location, and the seller’s...

Urban Company: Critical full compromise of jarvis-new.urbanclap.com via weak session signing

Summary Hi there, I discovered that jarvis-new.urbanclap.com uses a weak Flask session key. Because Flask sessions are signed with a static secret, if this secret is known to an attacker then they can modify the session state. In this case, we can modify the Redash userid for the session and log ...