577 matches found
CVE-2024-12993 Location information exposure in Infinix Weather app
Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider and reveal the user’s location without any privileges. After multiple attempts to contact the vendor we did not receive any answer. We...
CVE-2024-55186
An IDOR Insecure Direct Object Reference vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging...
CVE-2024-55946
Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have...
CVE-2024-55946 Playloom Engine Data Storage Vulnerability
Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have...
CVE-2024-55946
Summary (CVE-2024-55946): Playloom Engine (Engine Beta v0.0.1) has a data-storage privacy vulnerability in collaboration features, risking exposure of personal information entered by users when collaborating with others. The issue is being addressed by temporarily disabling the collaboration feat...
CVE-2024-55946
Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have...
PT-2024-36612
Name of the Vulnerable Software and Affected Versions Playloom Engine version 0.0.1 Description The issue is related to data storage, specifically when using the collaboration features in Playloom Engine. When collaborating with another user, they may have access to personal information entered...
CVE-2024-54661
The socat utility (versions through 1.8.0.1 ) is vulnerable to an arbitrary file overwrite due to a predictable directory issue. Specifically, the readline.sh script relies on the /tmp/$USER/stderr2 file, which allows a local attacker to manipulate files via symlinks or predictable paths. This vu...
These cars want to know about your sex life (re-air) (Lock and Code S05E25)
This week on the Lock and Code podcast … Two weeks ago, the Lock and Code podcast shared three stories about home products that requested, collected, or exposed sensitive data online. There were the air fryers that asked users to record audio through their smartphones. There was the smart ring...
webkitgtk: A maliciously crafted webpage may be able to fingerprint the user
A flaw was found in WebKit. This vulnerability allows a maliciously crafted webpage to fingerprint the user...
Svakom Siime Eye 安全漏洞
Svakom Siime Eye is a smart home device from Svakom, USA. A security vulnerability exists in Svakom Siime Eye version 14.1.00000001.3.330.0.0.3.14, which stems from the use of a default SSID value that makes it easier for a remote attacker to discover the physical location of the device, violatin...
CVE-2024-51362
The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue due to missing authentication for critical functions. An unauthenticated attacker with network access can view live camera footage by accessing the RTSP protocol on port 8554 . This vulnerability allow...
CVE-2024-44262
This issue was addressed with improved redaction of sensitive information. This issue is fixed in visionOS 2.1. A user may be able to view sensitive user information...
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Summary A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. Details Here's the offending line:...
CVE-2024-39339
A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars. This misconfiguration can lead to information disclosure, leaking sensitive details such as diagnostic log traces, system logs, headunit passwords, and personally...
CVE-2024-39339
A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars. This misconfiguration can lead to information disclosure, leaking sensitive details such as diagnostic log traces, system logs, headunit passwords, and personally...
CVE-2024-44115
The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application...
Dahua Security Cameras Improper Authentication (CVE-2017-9316)
Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device...
Google admits it can’t quite quit third-party cookies
For more than a year, Google has said it would phase out the third-party tracking cookies that power much of its advertising business online, proposing new ideas that would allegedly preserve user privacy while still providing businesses with steady revenue streams. This week, Google tossed much ...
