Are Smart Home Devices Invading Your Privacy?

By Owais Sultan Smart home devices are becoming more and more popular in recent years, promising convenience and automation to enhance… This is a post from HackRead.com Read the original post: Are Smart Home Devices Invading Your Privacy?...

A week in security (April 10 - 16)

Last week on Malwarebytes Labs: How the cops buy a "God view" of your location data, with Bennett Cyphers: Lock and Code S04E09 Apple releases emergency updates for two known-to-be-exploited vulnerabilities Don't plug your phone into a free charging station, warns FBI KFC, Pizza Hut owner employe...

Design/Logic Flaw

XWiki Commons are technical libraries common to several other top level XWiki projects. It's possible to list some users who are normally not viewable from subwiki by requesting users on a subwiki which allows only global users with uorgsuggest.vm. This issue only concerns hidden users from main...

Brave Software: Open redirect due to scanning QR code via brave browser

An open redirect vulnerability was discovered in Brave's QR code scanner, which allowed attackers to direct users to malicious sites without their consent or knowledge. This vulnerability put the security of Brave users at risk and allowed them to be exposed to phishing and malware attacks. The...

PT-2023-21397 · Mybb · Export User Plugin

Name of the Vulnerable Software and Affected Versions: Export User plugin through 2.0 for MyBB Description: The issue allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User Title, Location, or Bio field. This affects products that are no longer supported b...

How the cops buy a "God view" of your location data, with Bennett Cyphers: Lock and Code S04E09

The list of people and organizations that are hungry for your location data--collected so routinely and packaged so conveniently that it can easily reveal where you live, where you work, where you shop, pray, eat, and relax--includes many of the usual suspects. Advertisers, obviously, want to sen...

The vulnerability of the Apache InLong data integration platform, related to the recovery of unreliable data in memory, allows attackers to compromise privacy, integrity, and accessibility of the data.

The vulnerability of the Apache InLong data integration platform lies in the recovery of unreliable data in memory. Exploiting this vulnerability allows a remote attacker to compromise privacy, integrity, and accessibility of the data...

CVE-2022-32871

CVE-2022-32871 (Apple iOS) stems from a logic issue that could allow a person with physical access to a device to use Siri to access private calendar information. Several connected sources confirm the issue and its remediation: iOS 16 includes fixes that tighten restrictions around Siri-access to...

CVE-2022-46703

Summary : CVE-2022-46703 is an Apple security vulnerability described as a logic issue that could allow an app to read sensitive location information. Affected products/versions include iOS and iPadOS prior to the fixed releases, and macOS Ventura prior to 13.1; per sources, fixes are in iOS 15.7...

Google aims to reduce data theft with app data and account deletions

Google has made multiple security improvements to the general operation of apps over the last 12 months or so. Its now a little easier to understand what apps want from you. Labels which indicate a level of trustworthiness for developers. Changes made to ensure old, abandoned apps will no longer...

New tool allows you to opt out of Facebook's targeted advertising

After Meta Facebook and Instagram switched the legal basis for targeting advertising from automatic consent to opt-out, privacy watchdog noyb has built a tool for users to opt out of targeted advertising and various other claims made by Meta in an easy and legally sound way. After losing several...

CVE-2023-24006 WordPress WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups Plugin <= 2.6.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Cross-Site Scripting XSS vulnerability in Link Software LLC WP Terms Popup plugin = 2.6.0 versions...

Stop! Are you putting sensitive company data into ChatGPT?

Helping to reduce costs and enhance productivity are both things that your employer will look kindly upon. But what if you use an external tool for those tasks and the tasks involve confidential data that ended up on a server outside of the control of your company? Thats a problem. As a news writ...

thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to DOM cross-site scripting XSS because it fails to sanitize user input in the configuration privacy note URL parameter. This has been fixed in 3.1.12...

GHSA-JPH3-3J24-PG3J thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to DOM cross-site scripting XSS because it fails to sanitize user input in the configuration privacy note URL parameter. This has been fixed in 3.1.12...

Browser back attack vulnerability

Description rosariosis has a vulnerability that allows user to return to a page containing personally identifiable information PII and sensitive information even after logging out of the application by using the browser's back button. This issue poses a significant risk to the confidentiality of...

TikTok misused children's data, faces $15.6M fine

TikTok has been ordered to pay a fine of $15.6M £12.7M for failing to protect 1.4 million UK children under the age of 13 from accessing its platform in 2020. The Information Commissioner's Office ICO, the UK's data protection watchdog, imposed the fine after finding the company used children's...

PT-2023-17310 · Thorsten · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.1.12 Description: The issue is related to Cross-site Scripting XSS - DOM, where the software fails to sanitize user input in the configuration privacy note URL parameter. This allows for potential...

ChatGPT Has a Big Privacy Problem

Italy’s recent ban of Open AI’s generative text tool may just be the beginning of ChatGPT's regulatory woes...

Mullvad VPN and Tor Project Release Mullvad Browser

By Waqas Mullvad VPN and the Tor Project Join Forces to Launch Mullvad Browser, a Privacy-Focused Web Browser. This is a post from HackRead.com Read the original post: Mullvad VPN and Tor Project Release Mullvad Browser...