Bykea: Exposed trip_no in WebSocket Responses Leading to Excessive information Disclosure

The vulnerability in Bykea's WebSocket implementation was that the tripno identifier was exposed to drivers before a bid was accepted. This identifier could be used to access customer tracking URLs, revealing excessive information of the customers to unauthorized drivers. The issue was resolved b...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2023-42663 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2023-42663 Source advisory: OSV:GHSA-32WR-QQW6-5MFP...

data-tracking (1.7.3) potentially affected by CVE-2023-42663 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-42663 Source advisory: OSV:GHSA-32WR-QQW6-5MFP...

data-tracking (1.7.3) potentially affected by CVE-2023-42780 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-42780 Source advisory: OSV:GHSA-CGX2-RRMR-JX43...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2023-42792 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2023-42792 Source advisory: OSV:GHSA-J3W8-2P2H-MRR9...

data-tracking (1.7.3) potentially affected by CVE-2023-42792 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-42792 Source advisory: OSV:GHSA-J3W8-2P2H-MRR9...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2023-42780 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2023-42780 Source advisory: OSV:PYSEC-2023-202...

data-tracking (1.7.3) potentially affected by CVE-2023-42663 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-42663 Source advisory: OSV:PYSEC-2023-197...

data-tracking (1.7.3) potentially affected by CVE-2023-42780 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-42780 Source advisory: OSV:PYSEC-2023-202...

data-tracking (1.7.3) potentially affected by CVE-2023-42792 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2023-42792 Source advisory: OSV:PYSEC-2023-203...

Lack of validation allows invalid ticks, impacting data integrity.

Lines of code Vulnerability details Impact Function crossTicks updates the tick tracking data when ticks are crossed, but does not validate that exitTick and entryTick are valid and make sense. For example, exitTick could be lower than entryTick. Proof of Concept Here is the relevant code in the...

CrossTicks is not called when Users claimConcentratedRewards.

Lines of code Vulnerability details Vulnerability Details The crossTicks function is called to keep track and update the ticks whenever a tick is crossed, as specified by the Natspec /// @notice Keeps track of the tick crossings /// @dev Needs to be called whenever a tick is crossed function...

PT-2023-29284 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS version 9.2.1 Description: The issue concerns multiple Cross Site Scripting XSS vulnerabilities that allow an attacker to execute arbitrary code via a crafted script. This can be done by exploiting the Header and Footer Tracking...

Unexpected behavior when settings rewards for existing pools or past/ongoing periods

Lines of code Vulnerability details Summary There are different missing considerations in the liquidity mining process that may lead to unexpected behavior due to failed assumptions. Impact The liquidity mining feature is mainly implemented by tracking liquidity at a global level the aggregation ...

Malicious code in f0-fpti-tracking-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ca857aba5d033c511a1378d71e0ac64828687fe8dfef05c287c6d939a148fa4 index.js runs automatically via a preinstall lifecycle hook on npm install and collects host identifiers from the installer's machine — os.hostname,...

CVE-2023-4586

creationtimestamp| type| source ---|---|--- 2023-10-04 14:11:48+00:00| seen| https://t.me/cibsecurity/71553 2023-11-10 22:21:08+00:00| seen| https://t.me/arpsyndicate/66 2023-11-13 20:41:52+00:00| seen| https://t.me/arpsyndicate/174 2025-02-01 05:06:08+00:00| seen|...

The Team Helping Women Fight Digital Domestic Abuse

Location-enabled tech designed to make our lives easier is often exploited by domestic abusers. Refuge, a UK nonprofit, helps women to leave abusive relationships, secure their devices, and stay safe...

Gen Z fears physical violence from being online more than anyone else, Malwarebytes finds

The "version history" of the internet was split by what we could do online--simple browsing across Web 1.0s static web pages, instant connection throughout Web 2.0s social platforms, and, into the future, potential new forms of ownership within Web 3.0s dreams of decentralization. But, as...

How to Stop Google Bard From Storing Your Data and Location

Checking out this AI chatbot's new features? Make sure to keep these privacy tips in mind during your interactions...

CVE-2023-43702

Os Commerce is currently susceptible to a Cross-Site Scripting XSS vulnerability. This vulnerability allows attackers to inject JS through the "trackingnumber" parameter, potentially leading to unauthorized execution of scripts within a user's web browser...