CVE-2022-3060

Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests...

CVE-2022-3060

Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests...

CVE-2022-3060

Removed by vendor...

CVE-2022-42889

creationtimestamp| type| source ---|---|--- 2022-10-13 16:27:41+00:00| seen| https://t.me/cibsecurity/51317 2022-10-17 19:15:55+00:00| published-proof-of-concept| https://t.me/proxybar/1074 2022-10-17 22:38:10+00:00| published-proof-of-concept| https://t.me/cibsecurity/51631 2022-10-18...

ROS-20221013-02

The vulnerability in the Moodle course management system is related to the fact that the H5P attempted action report does not group permissions are not taken into account when displaying to non-editing teachers information about attempts/users in groups to which they should not have access. about...

A week in security (October 3 – 9)

Last week on Malwarebytes Labs: Romance scammer deepfakes Mark Ruffalo to con elderly artist Actively exploited vulnerability in Bitbucket Server and Data Center Ransomware-affected school district refuses to pay, gets stolen data released Ransomware review: September 2022 Huge increase in smishi...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2022-41672 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2022-41672 Source advisory: OSV:GHSA-3Q8R-F3PJ-3GC4...

data-tracking (1.7.3) potentially affected by CVE-2022-41672 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2022-41672 Source advisory: OSV:GHSA-3Q8R-F3PJ-3GC4...

data-tracking (1.7.3) potentially affected by CVE-2022-41672 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2022-41672 Source advisory: OSV:PYSEC-2022-42983...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2022-41672 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2022-41672 Source advisory: OSV:PYSEC-2022-42983...

Threat Source newsletter (Oct. 6, 2022) — Continuing down the Privacy Policy rabbit hole

As I wrote about last week, Ive been diving a lot into apps privacy policies recently. And I was recently made aware of a new type of app I never knew existed -- family trackers. There are countless mobile apps for parents to track their children or other family members based on their location,...

WordPress Microsoft Advertising Universal Event Tracking XSS

The vulnerability of the Microsoft Advertising Universal Event Tracking UET plugin for WordPress content management systems exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

TikTok's "secret operation" tracks you even if you don't use it

Consumer Reports CR, a US-based nonprofit consumer organization, has revealed that TikTok gathers data on people who don't even use the app itself. If this sounds familiar, it's because it's happened before. Meta's near-omnipresence wherever you are online enabled it to gather data on users, even...

CVE-2022-35914

creationtimestamp| type| source ---|---|--- 2022-10-04 11:01:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6910 2022-10-10 16:30:23+00:00| published-proof-of-concept| https://t.me/MrVGunz/553 2022-10-11 16:30:21+00:00| published-proof-of-concept|...

CVE-2022-2315

Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2...

CVE-2022-2315

Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2...

Sql injection

Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2...

PT-2022-15882

Name of the Vulnerable Software and Affected Versions Database Software Accreditation Tracking/Presentation Module product versions prior to 2 Description The issue is related to an unauthenticated SQL Injection vulnerability. This vulnerability is fixed in version 2 of the product. Recommendatio...

SQL Injection Vulnerability in DataBank Database Software Accreditation Tracking/Presentation Module

DataBank Database Software Accreditation Tracking/Presentation Module is a Database Software Accreditation Tracking/Presentation Module from DataBank Turkey. A security vulnerability exists in previous versions of DataBank Database Software Accreditation Tracking/Presentation Module v2, which...

CVE-2022-2315: Improper Neutralization of Special Elements used in an SQL Command

Database Software Accreditation Tracking/Presentation Module product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2...