7451 matches found
Peloton accused of providing customer chat data to train AI
It seems that Peloton may have been providing more training than just for its customers, as its set to face court in California accused of using user chat data to train AI. Peloton Interactive, Inc. is a US-based exercise equipment and media company, known for its stationary bicycles, treadmills,...
CVE-2024-39927
Out-of-bounds write vulnerability exists in Ricoh MFPs and printers. If a remote attacker sends a specially crafted request to the affected products, the products may be able to cause a denial-of-service DoS condition and/or user's data may be destroyed...
CVE-2024-39881
Delta Electronics CNCSoft-G2 lacks proper validation of user-supplied data, which can result in a memory corruption condition. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process...
CVE-2024-31325
In multiple locations, there is a possible way to reveal images across users data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-31319
In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...
CVE-2024-31319
In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...
Trojanized jQuery Infiltrates npm, GitHub, and CDNs: Thousands of Packages at Risk
Phylum uncovers large-scale trojanized jQuery attacks targeting npm, GitHub, and CDNs. Malicious actors steal user form data through…...
Simple Online Banking System 1.0 SQL Injection
Exploit Title: Simple Online Banking System - SQLi Authentication Bypass Date: 6 Jul, 2024 CVE: N/A Exploit Author: bRpsd Vendor Homepage: https://www.sourcecodester.com/php/14868/banking-system-using-php-free-source-code.html Software Link:...
ExtremePacs Extreme XDS Security Vulnerability
ExtremePacs Extreme XDS is a service. A security vulnerability exists in ExtremePacs Extreme XDS versions prior to 3928, which stems from the presence of an improper privilege management vulnerability that allows the collection of user-supplied data...
OpenPLC Cross-Site Scripting Vulnerability
OpenPLC is an open source programmable logic controller. It can provide low-cost industrial solutions for automation and research. OpenPLC suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can ...
14Finger Security Vulnerability
14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in 14Finger version 1.1, which stems from the /api/admin/user component that allows an attacker to access all user information via a crafted GET request...
ResidenceCMS Cross-Site Scripting Vulnerability
ResidenceCMS is a fast, lightweight property management system. A cross-site scripting vulnerability exists in ResidenceCMS version 2.10.1, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to create malicious...
PT-2024-26533 · Mapos · Mapos
Name of the Vulnerable Software and Affected Versions: MAP-OS versions 4.45.0 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. Cross-site scripting is a type of security vulnerability that occurs when an attacker is able to inject malicious scripts into a...
golang: html/template: errors returned from MarshalJSON methods may break template escaping
A flaw was found in Go's html/template standard library package. If errors returned from MarshalJSON methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing subsequent actions to inject unexpected content into...
WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Settings & Users Data Dump vulnerability
Unauthenticated Settings & Users Data Dump vulnerability discovered by Dave Jong Patchstack in WordPress Plugin WishList Member X versions 3.26.7...
VulnCheck KEV: CVE-2023-7308
SecGate3600, a network firewall product developed by NSFOCUS, contains a sensitive information disclosure vulnerability in the /cgi-bin/authUser/authManageSet.cgi endpoint. The affected component fails to enforce authentication checks on POST requests to retrieve user data. An unauthenticated...
CVE-2024-37893
Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...
CVE-2024-38467
Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API...
Meta Pauses AI Training on EU User Data Amid Privacy Concerns
Meta on Friday said it's delaying its efforts to train the company's large language models LLMs using public content shared by adult users on Facebook and Instagram in the European Union following a request from the Irish Data Protection Commission DPC. The company expressed disappointment at...
Nextcloud 安全漏洞
Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an Access Control Error vulnerability that stems from a lack of access control, which can be exploited by an attacker to register an...