TikTok: Instance Page DOS within Organization on TikTok Ads

A vulnerability was found on the Instance Page service of TikTok Ads, which would allow an Operator to perform a Denial of Service DoS on the Front End of only their own organization. We thank @arsenelupin for reporting this to our team...

Russia Cracks Down on 4 Dark Web Marketplaces for Stolen Credit Cards

A special law enforcement operation undertaken by Russia has led to the seizure and shutdown of four online bazaars that specialized in the theft and sales of stolen credit cards, as the government continues to take active measures against harboring cybercriminals on its territory. To that end, t...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Siemens Nucleus RTOS-based APOGEE and TALON Products Improper Validation of Specified Quantity in Input (CVE-2021-31346)

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and = V2.3 and...

Privacy-by-design… not by accident

The concept of privacy-by-design was actually devised almost 30 years ago by Ann Cavoukian, PhD, former Ontario Information and Privacy Commissioner. If youre reading a blog about privacy, chances are good you have at least a passing familiarity with Dr. Cavoukians seminal contribution to the...

Best cyber security jobs in 2022 – Highest paying

Web protection is a worthwhile and quickly extending field that spotlights on shielding organizations from current attacks and guarding their information and frameworks. Specialists in network security distinguish blemishes, give programming and gear answers for diminish hazards, and foster plans...

CVE-2021-46561

controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new...

CVE-2021-46561

controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new...

Cve-Api 安全漏洞

Cve-Api is an open source repository for the Cve Program that contains the source of the Cve Service Api. A security vulnerability exists in Cve-Api that originates in controller org.controller.js in Cve-Api 1.1.1 prior to 5c50baf3bda28133a3bc90b854765a64fb538304 that allows organization...

The Infraud Organization Group Members Arrested by Russian Authorities

By Waqas The Infraud Organization was labeled as the dark webs largest cybercrime group after being indicted for stealing $530… This is a post from HackRead.com Read the original post: The Infraud Organization Group Members Arrested by Russian Authorities...

Improper Privilege Management in liukuo362573/yishaadmin

Description Hi there, there is another improper privilege management in /admin/OrganizationManage/Position/GetFormJson Proof of Concept 1. Access the link http://106.14.124.170:80/admin/OrganizationManage/Position/GetFormJson?id=16508640061130139 2. See that the page return with position data...

lcwa.org Cross Site Scripting vulnerability OBB-2343846

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

VMconf 22: Why Didn’t It Work As Planned and What’s Next?

Hello everyone! In this episode, I want to talk about VMconf 22. It was an experiment from the beginning. Is it possible to host a Vulnerability Management event with little effort and budget? Looks like no. So I would like to talk about why the original idea failed and the future of VMconf. The...

intermagnet.org Cross Site Scripting vulnerability OBB-2326507

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Shopify: Github base action takeover which is used in `github.com/Shopify/unity-buy-sdk`

Summary: Shopify have a github repository https://github.com/Shopify/unity-buy-sdk In the repository there is a github action, which is used a base action from an external github repository. That github account as not registered on github.com So I was able to takeover the account and host PoC...

nobuyo.org Cross Site Scripting vulnerability OBB-2314363

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-41262

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to SQL injection attacks by users with "member" privilege. Users are advised to upgrade to version 0.9.6 as soon as possible. There are no known...

CVE-2021-0982

In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-0982

In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...