Magento Security Bypass Vulnerability (CNVD-2019-40829)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A security bypass vulnerability exists in Magento. An attacker can exploit this vulnerability to bypass the email confirmation mechanism via a GET request capturing the relevant account data obtained from the POST...

Hackers Breach ZoneAlarm's Forum Site — Outdated vBulletin to Blame

ZoneAlarm, an internet security software company owned by Israeli cybersecurity firm Check Point Technologies, has suffered a data breach exposing data of its discussion forum users, the company confirmed The Hacker News. With nearly 100 million downloads, ZoneAlarm offers antivirus software,...

U.S. Dept Of Defense: CORS Misconfiguration Leads to Exposing User Data

Vulnerable Asset: https://██████/█████████/ Discovery: - Upon accessing the site we discover two specific response headers which indicates that a cross-domain request for sensitive information might be possible 1. Access-Control-Allow-Origin: injectable 2. Access-Control-Allow-Credentials: true -...

UBUNTU-CVE-2019-3866

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information...

PT-2019-5309 · Openstack +1 · Openstack-Mistral +1

Name of the Vulnerable Software and Affected Versions: openstack-mistral affected versions not specified Description: An information-exposure issue was found in openstack-mistral where undercloud log files containing clear-text information were made world readable. This could allow a malicious...

Unspecified Vulnerability in Books Component of Multiple Apple Products

Apple iOS and others are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.Apple macOS Catalina is a specialized operating system developed for Mac computers.Books is one of the e-book components. one of the...

CVE-2019-5533

In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail addre...

ThreatList: Google's Advertising Network Dominates Global Data Collection

When it comes to data collection, Google’s combined arsenal of advertising tools and services continue to help it dominate at a global level. Close behind are AOL Advertising, Moat and AppNexus. Each are singled out by researchers in new report that brings to mind the privacy-busting quote, “If...

Data collectors

Who owns data owns the world. And with the Internet taking over much of our daily lives, it has become far easier and faster to receive, collect, and analyze data. The average user cannot even imagine how much data gets collected on them. Besides technical information for example, about a...

CVE-2019-16698

The CVE-2019-16698 issue affects the TYPO3 Direct Mail extension (direct_mail) up to version 5.2.2. A missing access check in the backend module allows a user with restricted permissions (to fe_users) to view and export data of frontend newsletter subscribers. The condition is an information-disc...

WordPress ThemeMakers Blessing Premium Responsive theme Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers Blessing Premium Responsive theme is a religious website theme plugin used in it. A security vulnerability exists in...

WordPress ThemeMakers Goodnex Premium Responsive theme Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers.ThemeMakers Goodnex Premium Responsive theme is a responsive website theme plugin used in it. A security vulnerability exist...

Information Disclosure in extension "Direct Mail" (direct_mail)

A missing access check in the backend module of the extension allows a backend user without access to configured tables e.g. feusers, ttaddress to view and export data of users subscribed to a newsletter...

WordPress ThemeMakers GamesTheme Premium theme information leakage vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers GamesTheme Premium theme is a responsive website theme plugin used in it. A security vulnerability exists in WordPress...

WordPress ThemeMakers SmartIT Premium Responsive theme Information Disclosure Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.ThemeMakers SmartIT Premium Responsive theme is a responsive website theme plugin used in it. A security vulnerability exists in...

You Gave Your Phone Number to Twitter for Security and Twitter Used it for Ads

After exposing private tweets, plaintext passwords, and personal information for hundreds of thousands of its users, here is a new security blunder social networking company Twitter admitted today. Twitter announced that the phone numbers and email addresses of some users provided for two-factor...

Acronis: Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)

The vulnerability allowed an attacker to delete any user's added email, telephone, fax, address, and Skype via CSRF in a GET method without any CSRF protection on the Academy Acronis website. This could be exploited by an attacker to delete sensitive information of any user. The issue was fixed b...

Malicious Package

Overview Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...

Malicious Package

Overview Version 1.0.3 of bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.3 of this module is found installed you wi...

ns.borzasiasociatii.ro Improper Access Control vulnerability

Open Bug Bounty ID: OBB-984875 Security Researcher onuratali Helped patch 99 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting ns.borzasiasociatii.ro website and its users. Following...