Facebook introduces another way to track you – Link History

In what seems like yet another attempt to adapt its platform to prepare for new regulations, Facebook has started rolling out a new feature called Link History. Link History allows users to view and re-visit links they have visited with their Facebook browsing activity. Obviously Facebook will te...

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting...

How to comply with HIPAA requirements

Understanding the Grounds of HIPAA Let's take a deep dive into understanding the broad structure and intent behind the Act for the Secure Management and Duty of Patient Data ASMDPD, a landmark piece of legislation that has deeply transformed the healthcare sector since its inception at the turn o...

cloncurry.qld.gov.au Cross Site Scripting vulnerability OBB-3827914

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-20807

CVE-2024-20807 describes an implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16. The issue enables a local attacker to obtain sensitive information due to improper handling of implicit intents within the Samsung Email app. The vulnerability is documented across mul...

CVE-2023-50082

CVE-2023-50082 affects Aoyun Technology pbootcms v3.1.2 and is caused by Incorrect Access Control, enabling session leakage that can expose sensitive information and allow a user to avoid logging into the backend management platform. The provided connected documents consistently describe the issu...

CVE-2024-21633

creationtimestamp| type| source ---|---|--- 2024-01-03 18:31:58+00:00| seen| https://t.me/ctinow/162527 2024-01-04 01:37:23+00:00| seen| https://t.me/cibsecurity/74338 2024-01-07 21:36:47+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6387 2024-01-08 09:16:42+00:00| seen|...

CVE-2023-46742 CubeFS leaks users key in logs

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to th...

CVE-2023-47473

CVE-2023-47473 affects fuwushe.org iFair software, specifically versions 23.8_ad0 and earlier. The Red Hat/NVD entries describe a Directory Traversal that enables an attacker to read sensitive information through a crafted script, impacting confidentiality (C:H) with no changes to integrity or av...

Stack overflow

A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtionetflushtx function if guest features VIRTIONETFHASHREPORT, VIRTIOFVERSION1 and VIRTIONETFMRGRXBUF are enabled. This could allow a malicious user to overwrite local variables...

CVE-2023-33109

CVE-2023-33109 affects Qualcomm chipsets (and likely WLAN-related components) and describes a transient Denial of Service when processing a WMI P2P listen start command (0xD00A) issued from the host. The entry is corroborated by NVD/Red Hat/Android bulletin references; CVSS v3.1 vector is AV:N/AC...

CVE-2023-32884

In netdagent, the vulnerability is an information disclosure caused by an incorrect bounds check, enabling local escalation of privilege with System-level execution privileges. Affected component: netdagent (no specific versions provided in the connected docs). Impact is described as high for con...

CVE-2023-52185

Everest Backup (Everestthemes) for WordPress is affected by CVE-2023-52185, a Sensitive Information Exposure via log file vulnerability affecting Everest Backup up to version 2.1.9. Root cause is sensitive data being written to log files accessible by unauthorized actors; patch status is Patched ...

CVE-2023-6094 OnCell G3150A-LTE Series: Web Server Transmits Cleartext Credentials

A vulnerability has been identified in OnCell G3150A-LTE Series firmware versions v1.3 and prior. The vulnerability results from lack of protection for sensitive information during transmission. An attacker eavesdropping on the traffic between the web browser and server may obtain sensitive...

CVE-2023-6094

The CVE-2023-6094 entry describes a vulnerability in OnCell G3150A-LTE Series firmware versions prior to v1.3 where sensitive information is transmitted without protection. An attacker could eavesdrop on traffic between a web browser and the device/server to obtain sensitive data. Affected produc...

Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions...

CVE-2023-50550

CVE-2023-50550 affects Layui up to version 2.74, where the vulnerability is a reflected/XSS via the data-content parameter. The underlying issue is a cross-site scripting flaw in the data-content handling, with CVSSv3.1 metrics: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (base score 5.4). Impact is Limi...

CVE-2023-51527

CVE-2023-51527 describes an Exposure of Sensitive Information to an Unauthorized Actor in the plugin AI Power: Complete AI Pack – Powered by GPT-4 . Reports indicate the vulnerability affects versions up to 1.8.2 and allows an unauthorized actor to access sensitive data. Related connected records...

CVE-2023-51687

CVE-2023-51687 affects Product Catalog Simple (Post Type-X) for WordPress, with Exposure of Sensitive Information to an Unauthorized Actor via product CSV for versions up to 1.7.6. Connected sources indicate the issue has been patched in a later release; upgrade to a version later than 1.7.6 to r...

CVE-2022-44589

CVE-2022-44589 affects miniOrange's Google Authenticator – WordPress Two Factor Authentication plugin, with exposure of sensitive information up to version 5.6.1. Affected versions are listed as n/a through 5.6.1. Multiple sources recommend upgrading to a version later than 5.6.1 (e.g., 5.6.2+). ...