Business Logic Errors

snipe/snipe-it is vulnerable to business logic errors. The vulnerability exists in the handle function of Authenticate.php because login enable does not block the old session which allows a malicious user to exploit the flaw and leak data...

Anonymous Hacks 2 Russian Industrial Firms, Leak 112GB of Data for Ukraine

By Waqas Anonymous has taken Operation OpRussia a step further by targeting MashOil and RostProekt, which happened to be giants… This is a post from HackRead.com Read the original post: Anonymous Hacks 2 Russian Industrial Firms, Leak 112GB of Data for Ukraine...

CVE-2022-24782

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...

Design/Logic Flaw

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...

CVE-2022-24782

Discourse versions 2.8.2 and earlier (stable), 2.9.0.beta3 and earlier (beta and tests-passed) are affected by a data‑leak vulnerability where exporting a user’s activity can reveal secure category names. The root cause is exposure of secure category information in exports (and when posts move to...

CVE-2022-24782 Secure category names leaked via user activity export in Discourse

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...

CVE-2022-24782 Secure category names leaked via user activity export in Discourse

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...

CVE-2022-25571

Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information leak which allows attackers to access the contents of the password file via unspecified vectors...

PT-2022-16875 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 2.8.2 and prior in the stable branch Discourse versions 2.9.0.beta3 and prior in the beta branch Discourse versions 2.9.0.beta3 and prior in the tests-passed branch Description: Discourse is an open source discussion...

RHEL 8 : Red Hat OpenStack Platform 16.2 (openstack-tripleo-heat-templates) (RHSA-2022:0995)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0995 advisory. Heat templates for TripleO Security Fixes: Data leak of internal URL through keystoneauthtoken CVE-2021-4180 For more details about the security...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-tripleo-heat-templates) security update

An update for openstack-tripleo-heat-templates is now available for Red Hat OpenStack Platform 16.2 Train. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

KLA12489 Multiple vulnerabilities in Opera

Multiple vulnerabilities were found in Opera. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Data leak vulnerability in Canvas can be exploited to cause denial of service. 2...

Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta

Both Microsoft and Okta are investigating claims by the new, precocious data extortion group Lapsus$ that the gang has breached their systems. Lapsus$ claimed to have gotten itself “superuser/admin” access to internal systems at authentication firm Okta. It also posted 40GB worth of files to its...

'This Is Really, Really Bad': Lapsus$ Gang Claims Okta Hack

Lapsus$ leaking Microsoft source code would be bad enough. Breaching Okta could be much, much worse...

LAPSUS$ Hackers Claim to Have Breached Microsoft and Authentication Firm Okta

Microsoft and authentication services provider Okta said they are investigating claims of a potential breach alleged by the LAPSUS$ extortionist gang. The development, which was first reported by Vice and Reuters, comes after the cyber criminal group posted screenshots and source code of what it...

CVE-2022-22659

A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An attacker in a privileged network position may be able to leak sensitive user information...

kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL

A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them...

Pandora Ransomware Hits Giant Automotive Supplier Denso

A multibillion supplier to key automotive companies like Toyota, Mercedes-Benz and Ford confirmed Monday that it was the target of a cyberattack over the weekend – confirmation that came after the Pandora ransomware group began leaking data that attackers claimed was stolen in the incident. The...

GHSA-7563-75J9-6H5P Sensitive Information Exposure in Sylius

Impact Any other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will...

Sensitive Information Exposure in Sylius

Impact Any other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will...