Spoutible Enhances Platform Security through Partnership with Wallarm

Spoutible, the rapidly growing social media platform known for its commitment to fostering a safe, inclusive, and respectful online community, has taken a significant step forward in its mission to ensure user safety, security and data integrity. Recognizing the critical importance of robust API...

phpMyFAQ Stored HTML Injection at contentLink

Summary Due to insufficient validation on the contentLink parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ...

GHSA-48VW-JPF8-HWQH phpMyFAQ Stored HTML Injection at contentLink

Summary Due to insufficient validation on the contentLink parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. Also, requires that adding new FAQs is allowed for guests and that the admin doesn't check the content of a newly added FAQ...

U.S. Justice Department Sues Apple Over Monopoly and Messaging Security

The U.S. Department of Justice DoJ, along with 16 other state and district attorneys general, on Thursday accused Apple of illegally maintaining a monopoly over smartphones, thereby undermining, among other things, the security and privacy of users when messaging non-iPhone users. "Apple wraps...

BIT-MOODLE-2021-40692

Insufficient capability checks made it possible for teachers to download users outside of their courses...

BIT-GITLAB-2023-5612 Missing Authorization in GitLab

An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled...

purple-directory.com GDPR PII Exposure vulnerability OBB-3861196

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-23330

CVE-2024-23330 affects Tuta (encrypted email service). In versions before 119.10, an attacker can cause an image in a HTML email to load from an external resource by default, despite protections intended to block external content. The issue occurs when displaying emails containing external conten...

The Definitive Enterprise Browser Buyer's Guide

Security stakeholders have come to realize that the prominent role the browser has in the modern corporate environment requires a re-evaluation of how it is managed and protected. While not long-ago web-borne risks were still addressed by a patchwork of endpoint, network, and cloud solutions, it ...

Google's New Tracking Protection in Chrome Blocks Third-Party Cookies

Google on Thursday announced that it will start testing a new feature called "Tracking Protection" starting January 4, 2024, to 1% of Chrome users as part of its efforts to deprecate third-party cookies in the web browser. The setting is designed to limit "cross-site tracking by restricting websi...

CVE-2023-49347

Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false...

Information Disclosure

github.com/mattermost/mattermost library is vulnerable to Information Disclosure. The vulnerability is due to Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, This allowing a member to get the full name of another user even if the Show Ful...

CVE-2023-45223

Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled...

CVE-2023-45223 Users full name disclosure through Mattermost Boards with Show Full Name Option disabled

Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another user even if the Show Full Name option was disabled...

Mozilla: Exposure of account recovery hint by querying by user email

The account recovery hint was exposed by querying the API with a user email. This allowed obtaining the hint and could enable phishing attacks...

CVE-2023-5561

Summary of CVE-2023-5561 findings : WordPress Core is vulnerable to a Sensitive Information Exposure via the REST User endpoint. Affected range: WordPress 4.7.0 through 6.3.1. The issue allows unauthenticated attackers to discern the email addresses of users who have published posts, by querying ...

Design/Logic Flaw

Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAMID/top/teammembers endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled...

CVE-2023-5160

CVE-2023-5160 : Mattermost fails to enforce the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint, enabling disclosure of a user’s full name even when the option is disabled. Connected sources confirm the vulnerability but do not provide concrete affected versions, root...

Code injection

UNSUPPPORTED WHEN ASSIGNED Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

The privacy perils of the Metaverse

A recently released report from New York University claims that the Metaverse, an all-in-one virtual online space, poses a potentially major risk to user privacy. This is because headsets and other similar devices can collect an incredible amount of personal, physical and biometric information. T...