SUSE CVE-2023-5388

NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

PT-2023-8422 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14 iOS versions prior to 17 iPadOS versions prior to 17 Description: The issue is related to insufficient access controls in the Photos Storage of macOS, iOS, and iPadOS operating systems. This may allow an attacker to...

CVE-2023-28195

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.3. An app may be able to read sensitive location information...

EmbedPress < 3.8.3 - Subscriber+ Plugin Settings Delete

Description The plugin does not properly authorize access to its adminpostremove and removeprivatedata actions, allowing low privileged users such as subscribers to delete plugin settings...

PT-2023-8418 · Apple · Ipados +3

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 16.6 iPadOS versions prior to 16.6 macOS Ventura versions prior to 13.5 Description: A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app to read sensitive...

CVE-2023-32388

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be able to bypass Privacy preferences...

AndroidRock Call Blocker 安全漏洞

AndroidRock Call Blocker is an application from AndroidRock Inc. It can automatically reject unwanted calls. A security vulnerability exists in AndroidRock Call Blocker version 6.6.3, which stems from an exposed component that deletes private data and can be exploited by an attacker to conduct a...

CVE-2023-2703

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users.This issue affects Competition Management System: before 23.07...

CVE-2023-2703

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Management System: before 23.07...

macOS 12.x < 12.6.6 Multiple Vulnerabilities (HT213759)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6.6. It is, therefore, affected by multiple vulnerabilities: - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, iOS 15.7.6 a...

PT-2023-22095 · Apache · Apache Openmeetings

Name of the Vulnerable Software and Affected Versions: Apache OpenMeetings versions 3.1.3 through 7.1.0 Description: The issue allows an attacker with access to certain private information to impersonate other users. Recommendations: For Apache OpenMeetings versions 3.1.3 through 7.1.0, update to...

CVE-2023-27510

JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may allow a remote unauthenticated attacker to obtain information entered from forms created using the affected product. The affected products and versions are as follows: JB Inquiry...

Microweber 安全漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. An information disclosure vulnerability exists in Microweber versions prior to 1.3.4,...

Information disclosure

The VTEX email protected GraphQL API module does not properly restrict unauthorized access to private configuration data. email protected is unaffected by this issue...

"BingBang" flaw enabled altering of Bing search results, account takeover

Researchers from Wiz have discovered a way to allow for search engine manipulation and account takeover. The research in question focuses on several Microsoft applications, with everything stemming from a new type of attack aimed at Azure Active Directory. Azure Active Directory is a single sign-...

BingBang: How a simple developer mistake could have led to Bing.com takeover

How a misconfiguration in a Microsoft Bing.com application allowed Wiz Research to modify Bing’s search results – and potentially compromise the private data of millions of Bing users...

PT-2023-19019 · Apple · Ios +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 macOS Big Sur versions prior to 11.7.5 iOS versions prior to 16.4 iOS versions prior to 15.7.4 iPadOS versions prior to 16.4 iPadOS versions prior to 15.7.4 watchOS versions prior to 9.4 Description: A privacy iss...

CVE-2023-20986

In btmbleclearresolvinglistcompletecomplete of btmbleprivacy.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Debian: Security Advisory (DSA-1734-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2009-0368

OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a 1 low level APDU command or 2 debugging tool, as demonstrated by reading the 4601 or 4701 file with the opensc-explorer or opensc-tool program...