DEBIAN-CVE-2020-35512

A use-after-free flaw was found in D-Bus Development branch = 1.13.16, dbus-1.12.x stable branch = 1.12.18, and dbus-1.10.x and older branches = 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in...

The ugidd RPC interface by design allows remote attackers to enumerate valid usernames by specifying arbitrary UIDs that ugidd maps to local user and group names.

...

OkCupid Dating App Flaws Could've Let Hackers Read Your Private Messages

Cybersecurity researchers today disclosed several security issues in popular online dating platform OkCupid that could potentially let attackers remotely spy on users' private information or perform malicious actions on behalf of the targeted accounts. According to a report shared with The Hacker...

Privilege Escalation

libsystemd.so are susceptible to privilege escalation. The attack exists because of an incomplete fix for CVE-2017-1000082 which does not properly handle parsing of usernames starting with a numeric digit, leading to misinterpretation of usernames into user identifiers. An attacker is able to...

CVE-2020-4092

"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expos...

Artica Pandora FMS Information Disclosure Vulnerability (CNVD-2020-20720)

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica Pandora FMS 7.42 and earlier versions. An attacker can exploit the vulnerability...

CVE-2020-8497

In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps...

DEBIAN-CVE-2019-16738

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup...

CVE-2014-10382

creationtimestamp| type| source ---|---|--- 2019-08-23 00:32:51+00:00| seen| https://t.me/cibsecurity/6326 2019-08-29 16:33:48+00:00| seen| https://t.me/cibsecurity/6443...

The vulnerability of the eLearning Server 4G system regarding access control allows a hacker to gain access and modify the user’s portfolio.

The vulnerability of the eLearning Server 4G system management and development framework is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain access—and modify—user portfolios by altering the value of the user identifier in HTTP request...

The vulnerability of the software platform for managing administrative policies and privileges, Policykit, arises from errors in processing large user identifier values, allowing attackers to bypass authentication procedures.

The vulnerability of the software platform for managing administrative policies and privileges via Policykit is related to errors in processing large user identifier values values exceeding INTMAX, which allows any systemctl command to be executed. Exploiting this vulnerability could enable a...

USN-3861-1 policykit-1 vulnerability

It was discovered that PolicyKit incorrectly handled certain large user UIDs. A local attacker with a large UID could possibly use this issue to perform privileged actions...

Today's app has an information leakage vulnerability

Today's headlines app is a large domestic information news platform with more than 100 million users. An information disclosure vulnerability exists in the Today's Headlines app. The vulnerability arises due to the fact that Today's Headlines fails to intercept high-volume request packets and...

OpenDolphin Information Disclosure Vulnerability

OpenDolphin is a free open source library that protects business applications from changing visualization technologies. OpenDolphin suffers from an information disclosure vulnerability that could be exploited by an attacker to gain access to sensitive information about other users, such as IDs an...

CVE-2017-16250

A vulnerability in Mitel ST 14.2, release GA28 and earlier, could allow an attacker to use the API function to enumerate through user-ids which could be used to identify valid user ids and associated user names...

HOT Man Android App Has Information Leakage Vulnerability

HOT Man Android APP is a mobile magazine software. There is an information leakage vulnerability in HOT Man Android APP. After registering and logging in to the system, an attacker can obtain sensitive information such as other users' UIDs, names, and cell phone numbers by clicking on "My Avatar"...

Growatt Monitoring System Android App Multiple Override Access Vulnerabilities

Growatt Monitoring System Android APP is a client application that provides PV monitoring services. Growatt Monitoring System Android APP has overstepped access vulnerabilities in multiple places. Attackers can obtain sensitive information, including: power plant equipment information, name, powe...

TouTou Shared Bike Android APP has an override access vulnerability

TouTou Shared Bike Android APP is a shared bike travel software for cities. TouTou Shared Bicycle Android APP has an override access vulnerability. After registering and logging into the system, the attacker can modify the user ID by grabbing packets to view any account information, including:...

CVE-2017-3743

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility ASU, UpdateXpress System Pack Installer UXSPI or Dynamic System Analysis DSA to a second machine, the other users may be able to see the user ID...

UBUNTU-CVE-2016-6190

SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all...