The vulnerability in the CoreText application programming interface of operating systems such as iOS, macOS, iPadOS, iPhoneOS, watchOS, and tvOS allows attackers to gain access to protected information.

The vulnerability of the CoreText application interface in iOS, macOS, iPadOS, iPhoneOS, watchOS, and tvOS systems relates to the ability to read data beyond the buffer in memory when processing a specially crafted font file. Exploiting this vulnerability can allow an attacker to gain access to...

Design/Logic Flaw

A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration...

Defunct marketing firm exposed 32GB worth of records, customers data

By Waqas According to researchers, the exposed database contained around 50,000 files and had 32GB worth of data. This is a post from HackRead.com Read the original post: Defunct marketing firm exposed 32GB worth of records, customers data...

The vulnerability of the Adobe Animate software for creating multimedia and computer animations lies in its ability to read data beyond the boundaries of the memory buffer. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Adobe Animate program for creating multimedia and computer animations is related to reading beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information in the context of the current user, usin...

CVE-2020-36319

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController...

USN-4501-1 luajit vulnerability

It was discovered that an out-of-bounds read existed in LuaJIT. An attacker could use this to cause a denial of service application crash or possibly expose sensitive information. CVE-2020-15890...

SQL Injection Vulnerability in Website Building System of Zhejiang Mufeng Website Technology Co.

Zhejiang Mufeng Website Technology Co., Ltd. is a website design company. Zhejiang Mufeng Website Technology Co., Ltd. website building system has SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information in the database...

Web exhibition PHP foreign trade enterprise website red style front SQL injection vulnerability

Netzhan Technology Beijing Century Netzhan Technology Co., Ltd. is an Internet service operator specializing in the field of exhibition shows. SQL injection vulnerability exists in the red style frontend of Nethub's PHP foreign trade enterprise website, which can be exploited by attackers to obta...

A Massive U.S. Property and Demographic Database Exposes 200 Million Records

More than 200 million records containing a wide range of property-related information on US residents were left exposed on a database that was accessible on the web without requiring any password or authentication. The exposed data — a mix of personal and demographic details — included the name,...

CVE-2019-6837

A Server-Side Request Forgery SSRF: CWE-918 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could cause server...

CVE-2019-6837

A Server-Side Request Forgery SSRF: CWE-918 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could cause server...

Design/Logic Flaw

An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users...

SQL Injection Vulnerability in the de***.aspx Page of CrowdSoft Web Application System

CrowdSoft is an independent and innovative software enterprise providing informationization services for government and enterprises and institutions. A SQL injection vulnerability exists in the de.aspx page of the CrowdSmart Software Web application system, which can be exploited by attackers to...

Exposed suppressed username or log in Special:EditTags

More info at https://phabricator.wikimedia.org/T222036...

The vulnerability of Docker images of Oracle WebLogic Server application servers allows a hacker to gain access to protected information.

The vulnerability of Oracle WebLogic Server application server Docker images is related to insufficient access control. Exploiting this vulnerability could allow an attacker to gain access to protected information using the T3 protocol...

Threatpost News Wrap Podcast For Jan. 18

Exposed personal data seemed to be the big trend this week, which was overshadowed by Troy Hunt’s discovery of a database of breached emails totaling 773 million unique addresses in a popular cloud service. Millions of sensitive files on a storage server belonging to the Oklahoma Department of...

Google+ to Shut Down Early After New API Flaw Hits 52.5 Million Users

Google today revealed that Google+ has suffered another massive data breach, forcing the tech giant to shut down its struggling social network four months earlier than its actual scheduled date, i.e., in April 2019 instead of August 2019. Google said it discovered another critical security...

Private data of more than 82 million US citizens left exposed

By Uzair Amir Misconfigured ElasticSearch Servers Exposed Private Data of over 82 Million Users. A warning has been issued by Bob Diachenko, a HackenProof security researcher informing users in the US that around 73 gigabytes of data is identified in a “regular security audit” of publicly...

A Dunkin' Donuts Hack, a Fake FedEx Site, and More Security News This Week

Scam centers, exposed massage company data, and more of the week's top security news...

Ansible Information Disclosure Vulnerability (CNVD-2018-12556)

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage and orchestrate computer systems. A security vulnerability exists in Ansible version 2.5 before 2.5.5 and version 2.4 before 2.4.5. An attacker can exploit the vulnerability to expose sensiti...