4023 matches found
Rocket.Chat: REST API gets `query` as parameter and executes it
Summary: Any user with 'view-d-room' permission can access any except users.services data from the users collection Description: The "users.list" REST endpoint gets a query parameter from JSON and runs Users.findqueryFromClientSide. This means virtually any authenticated user can access any data...
Call Center Provider Experiences Major Data Leak
By Habiba Rashid The exposed data was being updated in realtime with new logs while 1.48 million robocall logs were accessed by researchers initially. This is a post from HackRead.com Read the original post: Call Center Provider Experiences Major Data Leak...
Firm calls cops on researcher for responsibly disclosing data leak
By Habiba Rashid While white-hat hackers get paid for reporting flaws this particular researcher was reported to the police after responsibly disclosing a data leak. This is a post from HackRead.com Read the original post: Firm calls cops on researcher for responsibly disclosing data leak...
SQL Injection Vulnerability in SongCMS PHP Version of Guangdong Kegel Technology Limited (CNVD-2021-24954)
SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. A SQL injection vulnerability exists in the PHP version of SongCMS by Guangdong Kager...
Online trading broker FBS exposes 20TB of data with 16 billion records
By Waqas The leaked data also included unredacted credit cards and passports of millions of users around the world. This is a post from HackRead.com Read the original post: Online trading broker FBS exposes 20TB of data with 16 billion records...
REvil hackers demand $50M from Acer after threatening to leak data
By Habiba Rashid The biggest ransomware attack in history was observed on 18th March when cybercrime syndicate REvil demanded $50M from tech giant Acer. This is a post from HackRead.com Read the original post: REvil hackers demand $50M from Acer after threatening to leak data...
Security update for connman (moderate)
openSUSE Security Update: Security update for connman Announcement ID: openSUSE-SU-2021:0452-1 Rating: moderate References: 1181751 Cross-References: CVE-2021-26675 CVE-2021-26676 CVSS scores: CVE-2021-26675 NVD : 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-26676 NVD : 6.5...
CVE-2021-20634
CVE-2021-20634 is an improper access control vulnerability in Cybozu Office Custom App, affecting versions 10.0.0–10.8.4. An authenticated attacker can bypass access restrictions to obtain the Custom App date via unspecified vectors. The issue is documented across multiple feeds (NVD/Red Hat/CNVD...
nss: Check length of inputs for cryptographic primitives
A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability...
USN-4869-1 aria2 vulnerability
It was discovered that aria2 could accidentally leak authentication data. An attacker could possibly use this to gain access to sensitive information...
USN-4813-1 jackson-databind vulnerabilities
It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could possibly use this issue to obtain sensitive information. CVE-2018-11307, CVE-2019-12086, CVE-2019-12814 It was discovered that Jackson Databind incorrectly handled deserialization. An attacker could...
Updated ansible packages fix security vulnerability
User data leak in snmpfacts module CVE-2021-20178. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been patched to fix these issues...
Updated ansible packages fix security vulnerability
User data leak in snmpfacts module CVE-2021-20178. The bitbucketpipelinevariable module exposed secured values CVE-2021-20180. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been updated to version 2.9.18...
MGASA-2021-0131 Updated ansible packages fix security vulnerability
User data leak in snmpfacts module CVE-2021-20178. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been patched to fix these issues...
MGASA-2021-0132 Updated ansible packages fix security vulnerability
User data leak in snmpfacts module CVE-2021-20178. The bitbucketpipelinevariable module exposed secured values CVE-2021-20180. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been updated to version 2.9.18...
DEBIAN-CVE-2021-21183
Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2021-21184
Inappropriate implementation in performance APIs in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2021-21163
Insufficient data validation in Reader Mode in Google Chrome on iOS prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page and a malicious server...
