CVE-2017-7558

A kernel data leak due to an out-of-bound read was found in the Linux kernel in inetdiagmsgsctp,laddrfill and sctpgetsctpinfo functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic...

GitLab: Group search with Elastic search enable leaks unrelated data

Summary Performing a group search when Elastic Search is enabled provides access to unrelated merge requests, issues activity, leaking the existence of private groups, plus their activity and MRs. This happens both on the GUI and with the APIs Steps to reproduce Let's take this search on the Gitl...

CVE-2017-12613

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

Cisco IOS XE Software ISDN Data Leak Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a data leak vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information TRUSTED...

This Week in Security News: Fake Apps on iOS and Google Play and Social Media Security Issues

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the evolution of EDR to XDR and why your CISO should care, stock trading app attacks and fake gambling apps. Also, read about ho...

The vulnerability of D-Link DSL-2750U router microprogramming software, related to deficiencies in authentication procedures, allows attackers to trigger a service failure or disclose protected information.

The vulnerability of D-Link DSL-2750U router microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to cause service failures or expose protected information...

CVE-2019-12664 Cisco IOS XE Software ISDN Data Leak Vulnerability

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The...

CVE-2019-12664 Cisco IOS XE Software ISDN Data Leak Vulnerability

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The...

Cisco IOS XE Software ISDN Data Leak Vulnerability

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Integrated Services Routers ISRs could allow an unauthenticated, adjacent attacker to pass IPv4 traffic through an ISDN channel prior to successful PPP authentication. The...

CVE-2019-15740

GitLab CE/EE versions 7.9–12.2.1 are affected by CVE-2019-15740 due to EXIF geolocation data not being removed from certain image uploads, enabling disclosure of location metadata. Root cause: failure to strip EXIF data during uploads. Impact: potential exposure of geolocation information. Mitiga...

UNICEF Leaks Personal Data of 8,000 Users via Email Blunder

The charity organization UNICEF inadvertently leaked the personal details of thousands of people who use its online learning portal Agora by way of an errant email sent to 20,000 inboxes. The email was accidentally sent on August 26 by UNICEF and included the names, email addresses, gender and...

News Wrap: Deepfake CEO Voice Scam, Facebook Phone Data Exposed

In this week’s news wrap ended Sept. 6, the Threatpost team breaks down the biggest news of the week, including: Cybercrooks successfully fooling a company into a large wire transfer using an AI-powered deepfake of a chief executive’s voice and Facebook, Microsoft and a number of universities...

S-CMS php version hospital website building system v1.0 SQL injection vulnerability in background aj***.php page (CNVD-2019-32866)

S-CMS php version hospital website building system is a PHP based website building system. S-CMS php version hospital website builder system v1.0 has a SQL injection vulnerability in the background aj.php page, which can be exploited by attackers to obtain sensitive information from the database...

Data Leak Impacts Millions of Yves Rocher Cosmetics Company Customers

UPDATE Cosmetics giant Yves Rocher is warning that a giant data leak exposed the personal data of millions of its customers and reams of sensitive internal company information to the public. The data exposure stems from a database left unprotected by a third-party consultant to the firm...

S-CMS enterprise website builder system backend F_qs*** parameter exists SQL injection vulnerability

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. There is a SQL injection vulnerability in the Fqs parameter in the background of S-CMS enterprise website building system. Attackers...

Binance Confirms Hacker Obtained Its Users' KYC Data from 3rd-Party Vendor

As suspected, the KYC details of thousands of Binance's customers that hackers obtained and leaked online earlier this month came from the company's third-party vendor, Malta-based cryptocurrency exchange Binance confirmed. For those unaware, Binance, the world's largest cryptocurrency exchange b...

SQL Injection Vulnerability in the Website Building System of Beijing Beyond Infinity Information Technology Co. Ltd (CNVD-2019-30355)

Beijing Beyond Infinity Information Technology is a company engaged in website construction. A SQL injection vulnerability exists in the website building system of Beijing Beyond Unlimited Information Technology Co. Attackers can utilize the vulnerability to obtain sensitive information of the...

Semrush: Github information leaked

Researcher has found the third-party repository with test data for internal services development...

PT-2019-12214

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.15.0 Kubernetes versions prior to 1.14.4 Kubernetes versions prior to 1.13.8 Kubernetes versions prior to 1.12.10 Description The issue concerns the exposure of the debugging endpoint "/debug/pprof" over the...

NewStart CGSL CORE 5.04 / MAIN 5.04 : php Multiple Vulnerabilities (NS-SA-2019-0019)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has php packages installed that are affected by multiple vulnerabilities: - An integer overflow flaw, leading to a heap-based buffer overflow was found in the way libgd read some specially- crafted gd2 files. A remote attacker...