FetLife: Able to see location coordinates in any event without permission to do so

The vulnerability allowed attackers to view the location coordinates of events in the response of the /events/event-id endpoint, even when the event host had hidden the exact address from non-RSVP users. This was possible because the coordinates were included in the response regardless of the...

RUSTSEC-2024-0355 gix-path can use a fake program files location

Summary When looking for Git for Windows so it can run it to report its paths, gix-path can be tricked into running another git.exe placed in an untrusted location by a limited user account. Details Windows permits limited user accounts without administrative privileges to create new directories ...

Family Location Tracker App Life360 Breach: 443,000 Users’ Data Leaked

Life360, a popular family location tracker app, suffered a data breach affecting 443,000 users. Personal details, including first…...

Path Traversal

@jmondi/url-to-png is vulnerable to Path Traversal. The vulnerability is due to the lack of proper sanitization or validation of the ImageId input within extractqueryparams.ts, which allows an attacker to store an image in an arbitrary location that the server has permission to access...

CVE-2024-39918 Path Traveral in @jmondi/url-to-png

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the ImageId in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in ...

How to Set Up Syslog to Capture Logs Real Time on a Central Location

This article describes how set up a Syslog server when you are experiencing issues across multiple XenServers and need to capture logs real-time on a central location...

How to Successfully Test Citrix StoreFront Beacons Inside a Remote Desktop Session

This article describes how to successfully test the Citrix StoreFront Beacons functionality with Citrix Receiver 3.1 Standard or later when connecting to workstations using a Remote Desktop session RDP. By default, a configured Citrix Receiver 3.1 Standard or later with Beacons and stores always...

CVE-2024-32670

The CVE-2024-32670 entry relates to Samsung Galaxy SmartTag2 prior to version 0.20.04. The root cause is exposure of sensitive information via BLE advertising, which can allow an attacker to potentially identify the tag’s location. Affected product: Samsung Galaxy SmartTag2; affected component/fu...

PT-2024-24755 · Samsung · Samsung Galaxy Smarttag2

Name of the Vulnerable Software and Affected Versions: Samsung Galaxy SmartTag2 versions prior to 0.20.04 Description: The issue allows attackers to potentially identify the tag's location by scanning the BLE advertising, exposing sensitive information to unauthorized actors. Recommendations: For...

CVE-2024-32670: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identify the tag's location by scanning the BLE adversting...

SAMSUNG Galaxy SmartTag2 Security Vulnerability

SAMSUNG Galaxy SmartTag2 is a smart loss prevention device from Samsung South Korea. It can be located by Bluetooth. A security vulnerability exists in SAMSUNG Galaxy SmartTag2 versions prior to 0.20.04, which stems from the exposure of sensitive information to an unauthorized actor, which could...

Boston Business Journal Names Rapid7 as a Best Place to Work in Boston

On June 13th, 2024, Rapid7 was recognized by The Boston Business Journal as a Best Place to Work in Boston. This marks the 13th consecutive year Rapid7 has made the list, this time coming in at 8 in the extra large company category. Best Places to Work rankings are based on anonymous employee...

CVE-2024-34603

Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data...

CVE-2024-34603

Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data...

CVE-2024-34603

Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data...

CVE-2024-34603

CVE-2024-34603 concerns Samsung Message with improper access control that could let a local attacker access location data. Affected: Samsung Message versions prior to SMR Jul-2024 Release 1. Root cause: insufficient access control enabling local data leakage (location). Impact: exposure of locati...

CVE-2024-34603

Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data...

SAMSUNG Messages Security Breach

SAMSUNG Messages is a messaging application from the South Korean company Samsung SAMSUNG. Messages can be exchanged with any user with a phone number. SAMSUNG Messages suffers from a security vulnerability that stems from improper access control allowing a local attacker to access location data...

CVE-2024-34603: Undefined Security Weakness

Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data...

PT-2024-26018 · Samsung · Samsung Message

Name of the Vulnerable Software and Affected Versions: Samsung Message versions prior to SMR Jul-2024 Release 1 Description: The issue is related to improper access control, allowing local attackers to access location data. This could potentially lead to unauthorized access to sensitive...