China Surveillance Company Hacked

Last week, someone posted something like 570 files, images and chat logs from a Chinese company called I-Soon. I-Soon sells hacking and espionage services to Chinese national and local government. Lots of details in the news articles. These arent details about the tools or techniques, more the...

CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files...

CVE-2023-7165 JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files...

JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

Description The plugin doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files. A partial fix was released in 2.0.9.6, removing the ability to list the directory but still allowing direct...

JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

Description The plugin doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files. A partial fix was released in 2.0.9.6, removing the ability to list the directory but still allowing direct...

The vulnerability of the software for improving the performance of the wireless network in the Intel Connectivity Performance Suite, related to lack of access control, allows a hacker to disclose protected information.

The vulnerability of the software for improving the performance of the Intel Connectivity Performance Suite wireless network is related to lack of access control. Exploiting this vulnerability can allow a remote attacker to disclose protected information...

Artica Pandora FMS Security Vulnerability

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica Pandora FMS versions 700 through 772, which can be exploited to read arbitrary...

Hardcoded credentials

Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these credentials an attacker can retrieve information about the cameras, user information, and modify database records...

Dreamer CMS Security Vulnerability

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A security vulnerability exists in Dreamer CMS 4.1.3 and earlier versions, which originates from an unknown function in /upload/ueditorConfig?action=config that results in an accessible file or...

Danfoss AK-SM800A 授权问题漏洞

Danfoss AK-SM800A is a system manager from Danfoss, Denmark. Provides secure system control and monitoring A security vulnerability exists in Danfoss AK-SM800A version 3.3 and earlier, which stems from an authentication flaw that can be exploited by an attacker to generate web reports that disclo...

CVE-2023-38750

In Zimbra Collaboration ZCS 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed...

Incorrect Authorization

org.apache.pulsar:pulsar-functions-worker is vulnerable to Incorrect Authorization. The configuration of a source or sink could be accessed by an authenticated user without permission, potentially exposing credentials. This vulnerability is lessened by the fact that there are no known techniques...

Enphase Energy Installer Toolkit 信任管理问题漏洞

Enphase Energy Installer Toolkit is an installer toolkit from Enphase Energy, USA. Enphase Energy Installer Toolkit version 3.27.0 suffers from a trust management issue vulnerability that stems from hard-coded credentials embedded in the binary code of an Android application. An attacker could...

PT-2023-25074 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11. up to 1.11.18 Description: The issue allows attackers to execute a Server-Side Request Forgery SSRF and obtain information on the services running on the server via crafted requests in the social and links tools...

CVE-2023-25749

Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now confirm with users that they want to launch an external application before doing so. This bug only affects Firefox for Android. Other version...

ShipStation 安全漏洞

ShipStation is an e-commerce retail order carrier processing and shipping software from ShipStation. A security vulnerability exists in ShipStation version 1.0, which stems from a spelling error that can lead to a blank password and a successful NULL comparison, which can be exploited by an...

SUSE CVE-2017-1289

IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection XXE error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150...

CVE-2022-26239

The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to overwrite and manipulate executables and libraries. This allows attackers to access sensitive data...

How Whistleblowers Navigate a Security Minefield

Exposing wrongdoing is risky on the best of days. Whistleblower Aid cofounder John Tye explains the extensive steps needed to keep people safe...

Design/Logic Flaw

HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2...