Mozilla: Exposure of account recovery hint by querying by user email

The account recovery hint was exposed by querying the API with a user email. This allowed obtaining the hint and could enable phishing attacks...

CVE-2023-5561

Summary of CVE-2023-5561 findings : WordPress Core is vulnerable to a Sensitive Information Exposure via the REST User endpoint. Affected range: WordPress 4.7.0 through 6.3.1. The issue allows unauthenticated attackers to discern the email addresses of users who have published posts, by querying ...

Design/Logic Flaw

Mattermost fails to check the Show Full Name option at the /api/v4/teams/TEAMID/top/teammembers endpoint allowing a member to get the full name of another user even if the Show Full Name option was disabled...

CVE-2023-5160

CVE-2023-5160 : Mattermost fails to enforce the Show Full Name option at the /api/v4/teams/TEAM_ID/top/team_members endpoint, enabling disclosure of a user’s full name even when the option is disabled. Connected sources confirm the vulnerability but do not provide concrete affected versions, root...

Code injection

UNSUPPPORTED WHEN ASSIGNED Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity...

The privacy perils of the Metaverse

A recently released report from New York University claims that the Metaverse, an all-in-one virtual online space, poses a potentially major risk to user privacy. This is because headsets and other similar devices can collect an incredible amount of personal, physical and biometric information. T...

PT-2023-4838 · Atlasvpn · Atlasvpn

Name of the Vulnerable Software and Affected Versions: AtlasVPN affected versions not specified Description: The issue is related to the inclusion of features from an untrusted controlled area in the AtlasVPN client. Exploitation of this issue could allow a remote attacker to obtain a user's IP...

Tor: 'Request English versions of web pages for enhanced privacy' keeps previous (grayed out) settings

The vulnerability allowed an attacker to identify users who had changed their language settings in the Tor Browser. By exploiting JavaScript and HTTP fingerprinting techniques, the attacker could determine the user's language preferences, even if the user had enabled the "Request English versions...

25 most popular websites vs Malwarebytes Browser Guard

Do you know how many see-everything-you're-doing-on-the-web trackers get loaded into your browser when you watch a YouTube video? Would you care to guess? It's about sixty. Sixty. Six zero. Sixty trackers when you load one video. I know this because I decided to take Browser Guard, the...

New 'Deep Learning Attack' Deciphers Laptop Keystrokes with 95% Accuracy

A group of academics has devised a "deep learning-based acoustic side-channel attack" that can be used to classify laptop keystrokes that are recorded using a nearby phone with 95% accuracy. "When trained on keystrokes recorded using the video conferencing software Zoom, an accuracy of 93% was...

RFP Template for Browser Security

Increasing cyber threats and attacks have made protecting organizational data a paramount concern for businesses of all sizes. A group of experts have recognized the pressing need for comprehensive browser security solutions and collaborated to develop "The Definitive Browser Security RFP...

Meta subsidiaries must pay $14m over misleading data collection disclosure

Meta has run into yet another bout of court related issues--two subsidiaries have been ordered to pay $14 million regarding undisclosed data collection. The Australian case, which has rumbled on for the best part of two and a half years, has focused on claims related to a now discontinued Virtual...

CVE-2023-32654

A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.5. A user may be able to read information belonging to another user...

ladagroupgh.com GDPR PII Exposure vulnerability OBB-3530156

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

itworks.in.ua GDPR PII Exposure vulnerability OBB-3530152

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Proposed Massachusetts law to ban sale of your mobile location data

Cellular location phone data may be banned from sale in the state of Massachusetts, under a proposed law set to ruffle some data broker feathers. The selling of location data has long been a point of contention for privacy experts. As with so much bulk user data, claims of anonymity from the...

CVE-2023-1936

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to leak the email address of a user who created a service desk issue...

HackerOne: inviting collaborator using email disclose the hackerone account related to the user

The new HackerOne collaborator feature allowed users to disclose the HackerOne account associated with an email address without the invitee's interaction...

Strava heatmap loophole may reveal users' home addresses

Researchers at NC State University have outlined potential privacy issues with popular fitness app Strava which could lead to users' homes being pinpointed. The researchers' findings are detailed in a paper called Heat marks the spot: de-anonymising users' geographical data on the Strava heat map...

CVE-2023-2986

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. This is due to insufficient encryption on the user being supplied during the abandoned cart link decode through the plugin. This allows unauthenticated...