Dominion Voting Systems ImageCast X 安全特征问题漏洞

Dominion Voting Systems ImageCast X is an intuitive and configurable face-to-face voting solution from Dominion Voting Systems. A security vulnerability exists in Dominion Voting Systems ImageCast Precinct and ImageCast Evolution, which stems from a flaw in the pseudo-random number generator that...

CVE-2022-45118

OpenHarmony-v3.1.2 and prior versions had a vulnerability that telephony in communication subsystem sends public events with personal data, but the permission is not set. Malicious apps could listen to public events and obtain information such as mobile numbers and SMS data without permissions...

A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.

...

CVE-2021-3798

A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via CCreateObject, nor when CDeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack...

Design/Logic Flaw

Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many...

CVE-2022-31134 Zulip Server public data export contains attachments that are non-public

Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many...

CVE-2022-31134 Zulip Server public data export contains attachments that are non-public

Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many...

Microsoft Spills 38 Million Sensitive Data Records Via Careless Power App Configs

For months, Microsoft’s Power Apps portals exposed personal data tied to 38 million records ranging from COVID-19 vaccination status, Social Security numbers and email addresses. Consumers most affected by what is being called a “platform issue” are those doing business with American Airlines,...

PT-2021-11799 · Helmholz +1 · Myrex24.Virtual +2

Name of the Vulnerable Software and Affected Versions: MB connect line mymbCONNECT24 versions through v2.11.2 mbCONNECT24 versions through v2.11.2 Helmholz myREX24 versions through v2.11.2 Helmholz myREX24.virtual versions through v2.11.2 Description: An issue allows an authenticated attacker to...

Nextcloud: Directory listing is enabled that exposes non public data through multiple path

Directory Listing is enabled on https://try.nextcloud.com and it shows out a few files on the server + The server version. POC: https://try.nextcloud.com/assets/ https://try.nextcloud.com/css/ https://try.nextcloud.com/js/ Impact This could leak sensitive information on the server and it also...

GitGot - Semi-automated, Feedback-Driven Tool To Rapidly Search Through Troves Of Public Data On GitHub For Sensitive Secrets

GitGot is a semi-automated, feedback-driven tool to empower users to rapidly search through troves of public data on GitHub for sensitive secrets. How it Works During search sessions, users will provide feedback to GitGot about search results to ignore, and GitGot prunes the set of results. Users...

Facebook Suspends Analytics Firm Over Surveillance Concerns

Online data privacy is again being thrust into the spotlight after Facebook announced Friday it suspended yet another analytics firm due to concerns about the collection and sharing of data. The company is launching an investigation into whether Boston-based Crimson Hexagon’s collection of public...

Authentication flaw

Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors...

CVE-2018-0567

Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors...

CVE-2018-0567

Cybozu Office 10.0.0 to 10.8.0 is affected by CVE-2018-0567, an operation restriction bypass that allows a user (authenticated) to access and write data before it becomes public. The issue is documented across multiple sources (e.g., JVN/CNVD/OpenVAS/NVD) and is classified with a CVSS v3 base sco...

CVE-2018-0567

Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors...

SpiderFoot 2.12 - Automates OSINT to find out everything possible about your target

SpiderFoot is a reconnaissance tool that automatically queries over 100 public data sources OSINT to gather intelligence on IP addresses, domain names, e-mail addresses, names and more. You simply specify the target you want to investigate, pick which modules to enable and then SpiderFoot will...

Tracking People Without GPS

Interesting research: The trick in accurately tracking a person with this method is finding out what kind of activity they're performing. Whether they're walking, driving a car, or riding in a train or airplane, it's pretty easy to figure out when you know what you're looking for. The sensors can...

CENTCOM Says Massive Data Cache Found on Leaky Server is Benign

A massive archive of 1.8 billion publicly accessible social-media posts were found on the Amazon S3 storage buckets that belonged to a Pentagon contractor. The data was collected by the third-party contractor on the behalf of United States Central Command and United States Pacific Command...

Facebook, Twitter and Instagram Share Data with Location-based Social Media Surveillance Startup

Facebook, Instagram, Twitter, VK, Google's Picasa and Youtube were handing over user data access to a Chicago-based Startup — the developer of a social media monitoring tool — which then sold this data to law enforcement agencies for surveillance purposes, the ACLU disclosed Tuesday. Government...