MGASA-2021-0131 Updated ansible packages fix security vulnerability

User data leak in snmpfacts module CVE-2021-20178. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been patched to fix these issues...

CVE-2021-26887

An elevation of privilege vulnerability exists in Microsoft Windows when Folder redirection has been enabled via Group Policy. When folder redirection file server is co-located with Terminal server, an attacker who successfully exploited the vulnerability would be able to begin redirecting anothe...

Weseek GROWI 安全漏洞

GROWI is a team collaboration software. An access control error vulnerability exists in WESEEK GROWI 4.2.2 and earlier versions, which can be exploited by a remote, unauthenticated attacker to read a user's personal information and/or internal server information...

FluBot Android malware mimics FedEx, Chrome apps to steal user data

By Deeba Ahmed Cybersecurity company PRODAFT reports that newly discovered FluBot Android malware is impersonating an Android mobile banking application. This is a post from HackRead.com Read the original post: FluBot Android malware mimics FedEx, Chrome apps to steal user data...

Will Google’s Privacy Sandbox take the bite out of tracking cookies?

Third-party cookies have been the lynchpin of online advertising for many years. Plans to phase cookies out forever continue to run at a steady pace, with Google in the driving seat. In 2019, it announced its vision for a “Privacy Sandbox”. The building blocks for this were essentially: 1. Most...

CatDV 9.2 - RMI Authentication Bypass Exploit

Exploit Title: CatDV 9.2 - RMI Authentication Bypass Exploit Author: Christopher Ellis, Nick Gonella, Workday Inc. Vendor Homepage: https://catdv.com/ Software Link: https://www.squarebox.com/download/CatDVServer9.2.0.exe Version: 9.2 and lower Tested on: Windows, Mac import org.h2.engine.User;...

CVE-2021-21320

matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a blob origin that cannot access Matrix user data, so...

SUSE-SU-2021:0654-1 Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: - CVE-2020-28493: Fixed a ReDOS vulnerability where urlize could have been called with untrusted user data bsc1181944...

Nextcloud Deck Access Control Error Vulnerability (CNVD-2021-12652)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Deck before 1.0.2 that stems from an insecure direct object reference IDOR. An attacker could exploit the...

ISC BIND TKEY Query Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ISC BIND. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of TKEY queries. The issue results from the lack of proper validation of the lengt...

Daycare Webcam Service Exposes 12,000 User Accounts

NurseryCam, a webcam service used across 40 daycare centers in the U.K. by parents who want to keep a watchful eye on their babies, has shut down following a data breach. The breach exposed the personal data of about 12,000 users to an attacker who said he or she was trying to improve the service...

CVE-2020-8297

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference IDOR vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user...

Design/Logic Flaw

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference IDOR vulnerability that permits users with a duplicate user identifier to access deck data of a previous deleted user...

Nextcloud Deck 安全漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Deck before 1.0.2 that stems from an insecure direct object reference IDOR. An attacker could exploit the...

PT-2021-17066 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 8.x through 8.8.1 Description: The issue allows an attacker to see all users in the CMS using the API endpoint "/users/id". For each call, they get in response a lot of information about the user, such as email address, firs...

Red Hat Keycloak Input Validation Error Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak has an input validation error vulnerability that arises from not properly encoding user-supplied data fields and using...

CVE-2020-35734

Batflat CMS 1.3.6 is vulnerable to authenticated code injection leading to Remote Code Execution via input fields on the Users tab. Exploitation requires login to the admin panel and editing another user’s data (e.g., username or display name). Affected product/version: Batflat 1.3.6; vendor note...

TikTok: Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)

An unclaimed Amazon S3 bucket which no longer used for any TikTok applications and did not host any user data could have allowed a takeover on a musical.ly subdomain. We thank @daik0n for reporting this to our team...

CVE-2021-22663

Cscape All versions prior to 9.90 SP3.5 lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute code in the context of the current process...

Linux-Chrome-Recon - An Information Gathering Tool Used To Enumerate All Possible Data About An User From Google-Chrome Browser From Any Linux Distribution

"linux-chrome-recon" is a Information gathering tool used to enumerate all possible data about an user from Google-Chrome browser from any Linux distribution Intro 1.Loots possible data from Google-Chrome 2.Launches HTTP Server on /tmp directory Usefull 3.Simple script to receive data from...