South Korea Fines Meta $15.67M for Illegally Sharing Sensitive User Data with Advertisers

Meta has been fined 21.62 billion won $15.67 million by South Korea's data privacy watchdog for illegally collecting sensitive personal information from Facebook users, including data about their political views and sexual orientation, and sharing it with advertisers without their consent. The...

PT-2024-33152 · Aquilacms · Aquilacms

Name of the Vulnerable Software and Affected Versions: AquilaCMS versions 1.409.20 and prior Description: A NoSQL injection issue allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. Recommendations: For versions 1.409.20 and prior, ...

CVE-2023-0922

...

Lines Police CAD 安全漏洞

Lines Police CAD is an easy to set up and use police server from the individual developers at Merrill Lines. A security vulnerability exists in Lines Police CAD version 1.0 that originates from user interaction with a carefully constructed password reset link, allowing an attacker to obtain a...

CVE-2024-45982

CVE-2024-45982 affects scheduleR v0.0.18 and is described as a host header injection vulnerability. The underlying issue allows an attacker to obtain a password reset token by user interaction with a crafted password reset link, enabling arbitrary password resets and account compromise. The Red H...

CVE-2024-39836

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset...

CVE-2024-39836 Munged email address used for password resets and notifications

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset...

CVE-2024-39836 Munged email address used for password resets and notifications

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset...

CVE-2024-39836

Mattermost server vulnerable versions: 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x

CVE-2024-26520

An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets...

CVE-2024-26520

An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets...

CVE-2024-26520

The CVE-2024-26520 entry concerns Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1. Multiple connected sources confirm a vulnerability where an attacker can bypass authentication and perform arbitrary password resets. This affects the Rest...

PT-2024-21415 · Hangzhou Xiongwei Technology Development Co. · Restaurant Digital Comprehensive Management Platform

Name of the Vulnerable Software and Affected Versions: Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform version v1 Description: The issue allows an attacker to bypass authentication and perform arbitrary password resets. Recommendations: For...

PT-2024-27821

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.2.4 authentik versions prior to 2024.4.2 authentik versions prior to 2024.4.3 authentik versions prior to 2024.6.0 Description The authentik API-Access-Token mechanism can be exploited to gain admin user...

CVE-2024-38468

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API...

CVE-2024-38468

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API...

CVE-2024-38468

CVE-2024-38468 affects Shenzhen Guoxin Synthesis Image System prior to version 8.3.0. The vulnerability allows unauthorized password resets via the resetPassword API, exposing high-severity impact (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected component is the image system’s resetPass...

PT-2024-40384 · Typo3 Cms · Typo3/Cms

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS affected versions not specified Description: The issue arises from the improper validation of the HTTP host-header in TYPO3 CMS, making it susceptible to host spoofing. The HTTP host-header is used by TYPO3 to generate absolute URLs...

CVE-2024-1050

CVE-2024-1050 affects the Import and export users and customers WordPress plugin. A missing capability check in ajax_force_reset_password_delete_metas() allows authenticated subscribers+ to modify data by deleting all forced password resets. The issue impacts all versions up to 1.26.5; a patch is...

CVE-2024-1050 Import and export users and customers <= 1.26.5 - Missing Authorization

The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxforceresetpassworddeletemetas function in all versions up to, and including, 1.26.5. This makes it possible for authenticated attackers,...