5257 matches found
Nextcloud: Nextcloud domain and name of every user leaked to lookup server
Steps to reproduce: 0. Install and set up Nextcloud, optional: create a few random users 1. Apply the following patch to a standard Nextcloud server: patch diff --git a/settings/BackgroundJobs/VerifyUserData.php b/settings/BackgroundJobs/VerifyUserData.php index 56ebadff9c..76ed8b5ed3 100644 ---...
Saudi Arabia smart phone application Dalil is burst serious vulnerability: the more than 500 million users information was leaked-vulnerability warning-the black bar safety net
Dalil is a similar to Truecaller's smart phone application, but only limited to Saudi Arabia and other Arab regions of the user. Due to the application of the use of the MongoDB database can not enter the password in the case of online access, causing the user data of the continued leak of the we...
Smart Ski Helmet Headphone Flaws Leak Personal, GPS Data
Researchers have found a slew of vulnerabilities in a pair of smart headphones designed to fit under ski helmets. The flaws could allow a bad actor to view victims’ personal information, track them and even listen to their private conversations via the headphones’ walkie-talkie function, which us...
PT-2019-6138 · Linux +2 · Bluez +2
Name of the Vulnerable Software and Affected Versions: BlueZ versions through 5.48 Description: The issue is related to the implementation of the SDP service in the Bluetooth protocol stack for Linux BlueZ, which is associated with insufficient authentication of data. This can allow a remote...
CVE-2018-1949
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429...
CVE-2019-5766
Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
LPG Gas Company Leaked Details, Aadhaar Numbers of 6.7 Million Indian Customers
Why would someone bother to hack a so-called "ultra-secure encrypted database that is being protected behind 13 feet high and 5 feet thick walls," when one can simply fetch a copy of the same data from other sources. French security researcher Baptiste Robert, who goes by the pseudonym "Elliot...
CVE-2018-12006
In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Users with no extra privileges can potentially access leaked data due to uninitialized padding present in display function...
FreeBSD-SA-19:01.syscall
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-19:01.syscall Security Advisory The FreeBSD Project Topic: System call kernel data register leak Category: core Module: kernel Announced: 2019-02-05 Credits:...
HackerOne: Confidential data of users and limited metadata of programs and reports accessible via GraphQL
Summary: The GraphQL endpoint doesn't have access controls implemented properly. Description: Any attacker can get personally identifiable information of users of Hackerone such as email address, backup hash codes, facebookuserid, accountrecoveryphonenumberverifiedat, totpenabled, etc. These are...
PT-2019-13468
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 72.0.3626.81 Description The issue is related to an inappropriate implementation in JavaScript, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This could potentially expose sensiti...
PT-2019-4489 · Linux +6 · Linux Kernel +6
Name of the Vulnerable Software and Affected Versions: Linux kernel version 4.19.83 Description: The issue is related to a use-after-free read in the debugfs remove function in fs/debugfs/inode.c, which can be used to remove a file or directory in debugfs that was previously created with a call t...
Threatpost News Wrap Podcast For Jan. 18
Exposed personal data seemed to be the big trend this week, which was overshadowed by Troy Hunt’s discovery of a database of breached emails totaling 773 million unique addresses in a popular cloud service. Millions of sensitive files on a storage server belonging to the Oklahoma Department of...
Millions of Oklahoma Gov Files Exposed by Wide-Open Server
Millions of sensitive files on a storage server belonging to the Oklahoma Department of Securities were left exposed for a week – including credentials, internal docs and personal data stretching back decades. Researchers at UpGuard who discovered the data leak said that the publicly accessible...
VOIPO Database Exposes Millions of Texts, Call Logs
UPDATE An improperly secured database owned by a California voice-over-internet provider left millions of customer call logs, SMS message logs and credentials in plain text open for months for the taking. The database belongs to VOIPO, which provides mobile services for consumers and commercial...
NoSQL Injection
Overview Versions of loopback-connector-mongodb prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak. Recommendation Upgrade to version 3.6.0 or later. References -...
UBUNTU-CVE-2019-3460
A heap data infoleak in multiple locations including L2CAPPARSECONFRSP was found in the Linux kernel before 5.1-rc1...
Turns Out Kaspersky Labs Helped FBI Catch Alleged NSA Leaker
Remember "The Shadow Brokers" and the arrest of a former NSA contractor accused of stealing 50 Terabytes of top secret documents from the intelligence agency? It turns out that, Kaspersky Lab, which has been banned in US government computers over spying fears, was the one who tipped off the U.S...
SQL Injection Vulnerability in YXcmsApp1.4.7's ad***.php Page
YXcmsApp is a PHP and MySQL based enterprise building content management system CMS. A SQL injection vulnerability exists in the ad.php page of YXcmsApp 1.4.7, which can be exploited by attackers to obtain sensitive information from the database...
