PYSEC-2022-43011

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

CVE-2022-23485

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...

CVE-2022-23485

CVE-2022-23485 affects the Sentry Python library prior to 22.11.0. An attacker with a known valid invite link could manipulate a cookie to reuse the same invite across multiple accounts when joining an organization, enabling creation of multiple users and unauthorized organization membership. The...

Mobileiron Sentry 安全漏洞

Mobileiron Sentry is a Smart Gateway product from Mobileiron, Inc. A security vulnerability exists in Mobileiron Sentry versions prior to 22.11.0, where an attacker with a known valid invitation link could manipulate cookies to allow the same invitation link to be reused on multiple accounts when...

Privilege escalation

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This...

CVE-2022-23737 Improper Privilege Management in GitHub Enterprise Server leading to page creation and deletion

An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages via the API. To exploit this vulnerability, an attacker would need to be added to an organization's repo with write permissions. This...

HackerOne: Any organization's assets pending review can be downloaded

Steps to reproduce - sign in as any user - visit https://hackerone.com/organizations/:handle/assets/downloadpendingreviews.csv, where :handle is the organization you want to download the assets for Impact This may leak sensitive data about an organization's attack surface...

youth.org.mt Cross Site Scripting vulnerability OBB-3076501

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2020-26784

CVE-2020-26784 is referenced in Windows update records as a Denial of Service issue affecting Cluster Shared Volumes (CSV). The connected MSKBs (KB5012596, KB5012599, KB5012604, KB5012647, KB5012670) indicate that the CSV DoS issue is addressed/improved in the April 2022 security updates across m...

CVE-2018-8590

CVE-2018-8590 is a remote code execution vulnerability in Microsoft Word caused by improper handling of objects in memory. An attacker can exploit it by tricking a user into opening a specially crafted Word document, delivered via email, the web, or another vector. The connected TALOS blog entry ...

CVE-2020-1341

CVE-2020-1341 affects Microsoft Edge (Chromium-based). The issue is an Elevation of Privilege when DLLs are allowed to download without an additional user prompt. Exploitation requires a user to browse to a malicious site and initiate a DLL download, which could lead to elevated privileges on the...

CVE-2019-1491

Summary (CVE-2019-1491) : A Microsoft SharePoint Server information-disclosure vulnerability allows an attacker to read arbitrary files on the server by sending a specially crafted request. Public details from multiple sources confirm exploitation requires targeting affected SharePoint APIs and r...

CVE-2020-0817

CVE-2020-0817 corresponds to a remote code execution flaw in the Windows Remote Desktop Client. The connected advisory CPAI-2020-0074 states there is a remote code execution vulnerability in the Windows Remote Desktop Client and that successful exploitation could allow an attacker to run arbitrar...

CVE-2020-0818

Technical details for CVE-2020-0818 are not publicly available in the provided documents. Monitor for updates as information may be released later.

WordPress Organization chart plugin <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lana Codes Patchstack Alliance in the WordPress Organization chart plugin versions = 1.4.1. Solution Update the WordPress Organization chart plugin to the latest available version at least 1.4.2...

Bouncy Castle BC Code Issue Vulnerability

Bouncy Castle BC is a cryptographic library for C and Java applications organized by Bouncy Castle. A code issue vulnerability exists in Bouncy Castle BC-FJA versions prior to 1.0.2.4, which stems from a temporary key used by the BC-FJA FIPS module that may be zeroed out while the module is still...

Google TensorFlow code issue vulnerability (CNVD-2022-80685)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A code issue vulnerability exists in Google TensorFlow, which stems from a logical error in the organization of data, where the conversion from char to bool is undefined if the const char array is not 0...

Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti

Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti By Jambul Tologonov· November 22, 2022 Introduction On October 31, 2022, Yanluowang’s TOR site was hacked displaying a message “check and mate!! Yanluowang Matrix chat hacked @yanluowangleaks Time’s...

Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti

Yanluowang Ransomware Leaks Analysis: Organization, Collaboration with HelloKitty, Babuk and Conti By Jambul Tologonov· November 22, 2022 Introduction On October 31, 2022, Yanluowang’s TOR site was hacked displaying a message “check and mate!! Yanluowang Matrix chat hacked @yanluowangleaks Time’s...

CVE-2022-2944

The connected document details a vulnerability in the WordPress Countdown Widget plugin (WordPress) where versions prior to 3.1.9.3 are affected by an Admin+ Stored XSS flaw. The issue arises from inadequate sanitisation/escaping of certain parameters, enabling stored cross-site scripting by high...