81 matches found
Answer vulnerable to Insertion of Sensitive Information Into Sent Data
answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc...
PT-2023-17383 · Unknown · Answerdev/Answer
Name of the Vulnerable Software and Affected Versions: answerdev/answer versions prior to 1.0.8 Description: The issue concerns the insertion of sensitive information into sent data. Specifically, answerdev/answer, an open-source knowledge-based community software, does not strip EXIF geolocation...
answer 安全漏洞
answer is an open source knowledge-based community software. An information disclosure vulnerability exists in versions of answer prior to 1.0.8. The vulnerability stems from the fact that when a user uploads his logo, the EXIF geolocation data of the uploaded image is not stripped. An attacker...
SUSE CVE-2023-28833
Nextcloud server is an open source home cloud implementation. In affected versions admins of a server were able to upload a logo or a favicon and to provided a file name which was not restricted and could overwrite files in the appdata directory. Administrators may have access to overwrite these...
logos-vision.com Cross Site Scripting vulnerability OBB-3187169
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Mass email campaign with a pinch of targeted spam
Most mass malicious mailing campaigns are very primitive and hardly diverse, with the content limited to several sentences offering the user to download archives that supposedly contain some urgent bills or unpaid fines. The email messages may contain no signatures or logos, with typos and other...
Malicious Package
Overview yarn-design-system-logos is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious code in yarn-design-system-logos (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9006849a713475d0be0ef3619338ecd191969c2f0a3d9d8d310cd68e292e75a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-7328 Malicious code in yarn-design-system-logos (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9006849a713475d0be0ef3619338ecd191969c2f0a3d9d8d310cd68e292e75a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
logos-vision.com Cross Site Scripting vulnerability OBB-2540745
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
MISP 跨站脚本漏洞
MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.156, which stems from the u...
ipa security and bug fix update
4.6.8-5.0.1 - Blank out header-logo.png product-name.png - Replace login-screen-logo.png Orabug: 20362818 4.6.8-5.el79.10 - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server - Fix certrequest for KDC cert - Resolves: 2021444 - CVE-2020-25719...
alkyne (=0.1.0), dioxus-core (=0.1.2) +7 more potentially affected by CVE-2020-36456 via toolshed (>=0.4.0 <=0.8.1)
toolshed CARGO version =0.4.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - vip-712 =0.1.1 Source cves: CVE-2020-36456 Source advisory: OSV:GHSA-2R6Q-6C8C-G762...
BIMI: A Visual Take on Email Authentication and Security
There is a saying that goes something like, "Do not judge a book by its cover." Yet, we all know we can not help but do just that - especially when it comes to online security. Logos play a significant role in whether or not we open an email and how we assess the importance of each message. Brand...
Ghidra_Kernelcache - A Ghidra Framework For iOS Kernelcache Reverse Engineering
This framework is the end product of my experience in reverse engineering iOS kernelcache,I do manually look for vulnerabilities in the kernel and have automated most of the things I really wanted to see in Ghidra to speed up the process of reversing, and this proven to be effective and saves a l...
alkyne (=0.1.0), dioxus-core (=0.1.2) +7 more potentially affected by CVE-2020-36456 via toolshed (>=0.4.0 <=0.8.1)
toolshed CARGO version =0.4.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1 - vip-712 =0.1.1 Source cves: CVE-2020-36456 Source advisory: OSV:RUSTSEC-2020-0136...
logos-bremen.de Cross Site Scripting vulnerability OBB-1431234
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
WordPress Super Logos Showcase premium plugin <= 2.2 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability found by Eagle Eye in WordPress Super Logos Showcase premium plugin versions = 2.2. Solution Update the WordPress Super Logos Showcase premium plugin to the latest available version at least 2.3...
logosacademy.edu.hk XSS vulnerability
Open Bug Bounty ID: OBB-703063 Description| Value ---|--- Affected Website:| logosacademy.edu.hk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...
GitLab: EXIF metadata not stripped from JPG group logos
Summary: When uploading JPEG images as group logos on Gitlab, the EXIF metadata is not removed or changed in any way. Description: When setting up a group on Gitlab, you can upload a logo, and if you upload a JPEG with EXIF metadata on it, it isn't stripped. This can lead to disclosure of locatio...