CVE-2024-45050

CVE-2024-45050 affects the Ringer server used by the Ringer messaging app. Prior to version 1.3.1, the messages loading route did not verify that the requesting user was a member of the conversation, enabling any Lif Account holder to load any conversation between two users without permission. Th...

CVE-2024-40594

The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps...

CVE-2024-40594

The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps...

CVE-2024-40594

The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible to other apps...

CVE-2024-4520 Improper Access Control in gaizhenbiao/chuanhuchatgpt

An improper access control vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically in version 20240410. This vulnerability allows any user on the server to access the chat history of any other user without requiring any form of interaction between the users. Exploitation ...

Russian Operatives Expose German Military Webex Conversations

By Deeba Ahmed Leaked Military Audio Raises Stakes in Russia-Ukraine Conflict. This is a post from HackRead.com Read the original post: Russian Operatives Expose German Military Webex Conversations...

Mozilla Thunderbird 安全漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. Mozilla Thunderbird suffers from a security bypass vulnerability that is caused by the...

Signal Introduces Usernames, Allowing Users to Keep Their Phone Numbers Private

End-to-end encrypted E2EE messaging app Signal said it's piloting a new feature that allows users to create unique usernames not to be confused with profile names and keep the phone numbers away from prying eyes. "If you use Signal, your phone number will no longer be visible to everyone you chat...

Ski & bike helmets protect your head, not location or voice

TL;DR Livall smart ski and bike helmet app leaks the wearers real time position Group audio chat allows snooping on conversations Both issues are due to missing authorisation Bike app affects 1 million users, ski app affects a few thousand users Fixed by the vendor, but after we had to call on a...

CVE-2023-45149 Password of talk conversations can be bruteforced in Nextcloud

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the...

CVE-2023-45149 Password of talk conversations can be bruteforced in Nextcloud

Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce attempts. It is recommended that the...

Privilege Escalation

mattermost is vulnerable to privilege escalation. An attacker with system role permission can read DM conversations...

Google’s Bard conversations turn up in search results

Google is coming under scrutiny after people discovered transcripts of conversations with its AI chatbot Bard are being indexed in Google search results. Bard is Googles answer to ChatGPT, and allows users to have conversations with an AI. Services like these have attracted a lot of attention,...

The vulnerability of the Conversations messaging software, related to insufficient validation of input data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Conversations messaging software is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by opening a backup file...

Nextcloud: Password of talk conversations can be bruteforced

The password of talk conversations could be bruteforced by adding the password as a parameter on the GET request of the frontpage instead of sending a POST to the authentication endpoint. This allowed bypassing brute force protection of public talk conversation passwords...

PT-2023-5025 · Unknown · Conversations

Name of the Vulnerable Software and Affected Versions: Conversations affected versions not specified Description: The issue is related to insufficient input validation in the Conversations instant messaging software. Exploitation of this issue could allow a remote attacker to gain unauthorized...

Announcing The BlueHat Podcast: Listen and Subscribe Now!

Available today on all major podcast platforms is The BlueHat Podcast, a new series of security research focused conversations, continuing the themes from the BlueHat 2023 conference session recordings available to watch here. Since 2005, BlueHat has been where the security research community, an...

Large Language Models and Elections

Earlier this week, the Republican National Committee released a video that it claims was "built entirely with AI imagery." The content of the ad isnt especially novel--a dystopian vision of America under a second term with President Joe Biden--but the deliberate emphasis on the technology used to...

How to work from home securely, the NSA way

People working remotely is no longer unusual, so the National Security Agency NSA has produced a short Best Practices PDF document detailing how remote workers can keep themselves safe from harm. In fact, the guide can also be applied to people using computers at home generally and is written in ...

SUSE CVE-2005-3042

miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters line feed or carriage return...