7522 matches found
Apple Kills Its Plan to Scan Your Photos for CSAM. Here’s What’s Next
The company plans to expand its Communication Safety features, which aim to disrupt the sharing of child sexual abuse material at the source...
CVE-2022-3830
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2022-23746
The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender SNX. If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords...
CVE-2022-24188
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct...
PT-2022-16528 · Unknown · Ourphoto App
Name of the Vulnerable Software and Affected Versions: Ourphoto App version 1.4.1 Description: The issue concerns the disclosure of clear-text password information for picture frame devices through the "/device/signin" end-point. Specifically, the deviceVideoCallPassword and mqttPassword are...
CVE-2022-24188
The CVE-2022-24188 entry concerns Ourphoto App 1.4.1, where the /device/signin endpoint returns clear-text credentials (deviceVideoCallPassword and mqttPassword). The issue is compounded by lack of session management and insecure direct object references, enabling disclosure of passwords for othe...
Missing CSRF protection
Description Any user can Add Questions on FAQ section -- https://roy.demo.phpmyfaq.de/index.php?action=ask&categoryid=0 This section is vulnerable to CSRF. The aggressor can abuse this without prior knowledge of others'. The successful CSRF will send new questions from the victim's browser Captur...
This Android File Manager App Infected Thousands of Devices with SharkBot Malware
The Android banking fraud malware known as SharkBot has reared its head once again on the official Google Play Store, posing as file managers to bypass the app marketplace's restrictions. A majority of the users who downloaded the rogue apps are located in the U.K. and Italy, Romanian cybersecuri...
The vulnerability of Websoft HCM’s automation software for HR processes lies in the lack of protection for operational data, allowing attackers to gain unauthorized access to protected information.
The vulnerability of Websoft HCM’s automation software for HR processes is related to the lack of protection for operational data. Exploiting this vulnerability allows an attacker to send incorrect values to parameters, receive error messages, or obtain debugging information regarding installatio...
Mozilla: Fullscreen notification bypass
The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popup and window.print calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks...
PT-2022-26163 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.8 XWiki Platform versions prior to 14.4.2 XWiki Platform versions prior to 14.6RC1 Description: The issue allows an attacker to create many new schemas and fill them with tables by using a crafted user...
Telehealth Sites Put Addiction Patient Data at Risk
New research found pervasive use of tracking tech on substance-abuse-focused health care websites, potentially endangering users in a post-Roe world...
PT-2022-28186 · Unknown · Company Account Feature
Name of the Vulnerable Software and Affected Versions: Company account feature version 4 and later Description: A critical issue allows users with the Company admin role to assign any role to any user, bypassing subtree limitations. This also affects users with the role / assign policy, typically...
Vulnerabilities fixed in Grafana
Grafana Labs has fixed vulnerabilities in Grafana. A malicious party could potentially exploit the vulnerabilities to retrieve discover user accounts, use password resets to appropriate an account, or in specific cases where an environment is heavily loaded, to cause a race condition and thus gai...
Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns
The InterPlanetary File System IPFS is an emerging Web3 technology that is currently seeing widespread abuse by threat actors. Cisco Talos has observed multiple ongoing campaigns that leverage the IPFS network to host their malware payloads and phishing kit infrastructure while facilitating other...
CVE-2022-3258
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse...
CVE-2022-3258
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse...
Authentication flaw
Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse...
