CVE-2022-34776

Tabit - giftcard stealth. Several APIs on the web system display, without authorization, sensitive information such as health statements, previous bills in a specific restaurant, alcohol consumption and smoking habits. Each of the described APIs, has in its URL one or more MongoDB ID which is not...

CVE-2022-2921

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update...

Privilege escalation

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update...

CVE-2022-2921

CVE-2022-2921 affects notrinoserp prior to v0.7. The issue exposes private personal information to an unauthorized actor, enabling privilege escalation to a system administrator account. An attacker can reach protected actions (create/update companies; install/update languages; install/activate e...

CVE-2022-2921 Exposure of Private Personal Information to an Unauthorized Actor in notrinos/notrinoserp

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update...

PT-2022-19462 · Unknown · Notrinoserp

Name of the Vulnerable Software and Affected Versions: notrinoserp versions prior to v0.7 Description: The issue results in exposure of private personal information to an unauthorized actor, leading to privilege escalation to a system administrator account. This allows an attacker to gain access ...

CVE-2022-34775

Tabit - Excessive data exposure. Another endpoint mapped by the tiny url, was one for reservation cancellation, containing the MongoDB ID of the reservation, and organization. This can be used to query the http://tgm-api.tabit.cloud/rsv/management/reservationId?organization=orgId API which return...

Twitter Exposes Personal Information for 5.4 Million Accounts

Twitter accidentally exposed the personal information--including phone numbers and email addresses--for 5.4 million accounts. And someone was trying to sell this information. In January 2022, we received a report through our bug bounty program of a vulnerability in Twitters systems. As a result o...

It Might Be Our Data, But It’s Not Our Breach

Image: Shutterstock. A cybersecurity firm says it has intercepted a large, unique stolen data set containing the names, addresses, email addresses, phone numbers, Social Security Numbers and dates of birth on nearly 23 million Americans. The firms analysis of the data suggests it corresponds to...

Twitter data breach affects 5.4M users

Twitter has confirmed that it was breached last month via a now-patched 0-day vulnerability in Twitters systems, allowing an attacker to link email addresses and phone numbers to user accounts. This enabled the attacker to compile a list of 5.4 million Twitter user account profiles. "We want to l...

Stop Putting Your Accounts At Risk, and Start Using a Password Manager

--- Image via Keeper Right Now, Get 30% Off Keeper, the Most Trusted Name in Password Management. In one way or another, almost every aspect of our lives is online, so it's no surprise that hackers target everything from email accounts to banks to smart home devices, looking for vulnerabilities t...

HCL Technologies HCL Commerce Remote Store server 安全漏洞

HCL Technologies HCL Commerce is a software platform framework for e-commerce from HCL Technologies India. The software includes marketing, sales, customer and order processing functionality in a customizable and integrated package. It is a unified platform that provides the ability to conduct...

CVE-2021-27785 HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)

HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website...

CVE-2021-27785

HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website...

Fedora: Security Advisory for osmo (FEDORA-2022-e57547c384)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: osmo-0.4.4-2.fc36

Osmo is a handy personal organizer which includes calendar, tasks manager and address book modules. It was designed to be a small, easy to use and good looking PIM tool to help to manage personal information. In current state the organizer is quite convenient in use - for example, user can perfor...

PayPal phishing campaign goes after more than just your login credentials

A new phishing campaign targeting PayPal users aims to get extensive data from potential victims. The data its after includes government documents like passport, as well as selfie photos. In a nutshell, its an extensive form of information theft, the likes of which could result in someones identi...

Google Android Information Disclosure Vulnerability (CNVD-2022-63886)

Google Android Automotive Os is an operating system and platform from the U.S. company Google Google that runs directly on in-car hardware. Google Android 12L has an information disclosure vulnerability that could be exploited by attackers to read all notifications, including users' personal...

Threat Source newsletter (July 14, 2022) — Are virtual IDs worth the security risk of saving a few seconds in the TSA line?

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I’ve started flying again on a somewhat regular basis now that work conferences and out-of-state vacations are becoming a thing again. I took about 18 months or so off flying during the peak of the pandemic, but now...

Google Android 信息泄露漏洞

Google Android Automotive Os is an operating system and platform from the U.S. company Google Google that runs directly on in-car hardware. Google Android 12L has an information disclosure vulnerability that could be exploited by attackers to read all notifications, including users' personal...