Mail.ru: Exposed Credentials May Leads to Tarantool Infrastructure Leak

Application configuration data related to Tarantool project was leaked on github.com...

Home Depot Confirms Data Breach in Order Confirmation SNAFU

Home Depot has exposed the private order confirmations of hundreds of Canadian consumers, containing names, physical addresses, email addresses, order details and partial credit-card information. After customers began reporting that they had received hundreds of emails from the home-improvement...

Hackers blackmail vulnerable patients after psychotherapy clinic hack

By Deeba Ahmed Confidential Data of Thousands of Finnish Psychotherapy Clinic Patients Has Been Exposed after Data Breach. This is a post from HackRead.com Read the original post: Hackers blackmail vulnerable patients after psychotherapy clinic hack...

Kubernetes: Development Application Credentials + Information Exposed

Issue Description When I browsed through all the JS files on prow.k8s.io I came across a link called /config which contains a configuration disclosure for the development files URL Vulnerabilities https://prow.k8s.io/config Proof On Concept javascript - continuous-integration/travis-ci kubespray:...

CVE-2020-3483

Duo has identified and fixed an issue with the Duo Network Gateway DNG product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG...

CVE-2020-15253

Versions of Grocy = 2.7.1 are vulnerable to Cross-Site Scripting via the Create Shopping List module, that is rendered upon deleting that Shopping List. The issue was also found in users, batteries, chores, equipment, locations, quantity units, shopping locations, tasks, taskcategories, product...

CVE-2020-24721

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the...

CVE-2020-13324

A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API...

Mail.ru: Незащищённый экземпляр Zeppelin

Apache Zeppelin notebook at http://zp.premras2.m.smailru.net was made externally available due to coincidence of multiple misconfigurations...

125softnlp (=0.0.1), a2 (>=0.10.11 <=0.10.13) +4695 more potentially affected by CVE-2020-15193 via tensorflow (>=1.0.1 <=2.2.0)

tensorflow PYPI version =1.0.1, =0.10.11, =0.1.0, =0.0.0, =0.6.0, =0.1.6, =1.0.0, =0.0.1, =0.2.0, =0.6.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2020-15193 Source advisory: OSV:PYSEC-2020-116...

CVE-2020-15369

Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remo...

Embedded Crowd passes sensitive paramaters in the URL when adding a new or editing an existing user directory.

h3. Issue Summary While adding a new directory or editing an existing one the embedded crowd passes directoryId, xsrfTokenName and xsrfTokenValue parameters to the URL. h3. Environment Bitbucket 6.9.X, 7.4.X, 7.5.X, 7.6.X h3. Steps to Reproduce In Bitbucket navigate to Gear Icon User Directories;...

Microsoft Bing server exposed user search queries and location data

By Waqas Microsoft Bing server logged some horrific search terms including searchers for murder and child abuse content. This is a post from HackRead.com Read the original post: Microsoft Bing server exposed user search queries and location data...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists the security wrapper does not deny access to some exposed properties using the deprecated exposedProps mechanism on proxy objects...

CVE-2020-7945

Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access to them. This is resolved in Continuous Delivery for Puppet Enterprise 4.0.1...

USN-4501-1 luajit vulnerability

It was discovered that an out-of-bounds read existed in LuaJIT. An attacker could use this to cause a denial of service application crash or possibly expose sensitive information. CVE-2020-15890...

CVE-2020-14330

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

BSA-2020-1078

Security Advisory ID : BSA-2020-1078 Component : Supportlink CLI Revision : 2.0 Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An...

Dell EMC ECS Exposes Resource Vulnerability

Dell EMC Elastic Cloud Storage ECS is a suite of scalable, software-defined object storage solutions from Dell, USA. An exposed resource vulnerability exists in Dell EMC ECS versions prior to 3.5, which arises from improper management of system resources e.g., memory, disk space, files, etc. by a...

28,000 exposed printers hacked to highlight lack of printer security

By Waqas Researchers forced 28,000 printers worldwide to print out guidelines on printer security. This is a post from HackRead.com Read the original post: 28,000 exposed printers hacked to highlight lack of printer security...