1495 matches found
GHSA-8XJ2-47XW-Q78C Keycloak Insufficient Session Expiry
A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section...
CVE-2022-24890 Exposure of Private Personal Information to an Unauthorized Actor in Nextcloud Talk
Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There...
SES IT, Web Solutions, cdSoft, Onlinetools, Smart, Winhotel.MX – security vulnerabilities
SES IT und Web Solutions cdSoft Onlinetools-Smart Winhotel.MX 2021 is a hotel software from SES IT und Web Solutions, Germany. MX 2021 is a hotel software from SES IT und Web Solutions, Germany. cdSoft Onlinetools-Smart Winhotel.MX 2021 version contains a security vulnerability that originates in...
DEA Investigating Breach of Law Enforcement Data Portal
The U.S. Drug Enforcement Administration DEA says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment...
ICE Is a Domestic Surveillance Agency
Georgetown has a new report on the highly secretive bulk surveillance activities of ICE in the US: When you think about government surveillance in the United States, you likely think of the National Security Agency or the FBI. You might even think of a powerful police agency, such as the New York...
Steer clear of fake premium mobile app unlockers
A site has been bouncing around YouTube comments for the past couple of weeks. The site sometimes changes, the messages alter slightly, but the essence remains the same: In all cases, people acting in suspiciously automated fashion ask if everyone is using this "glitch" or generator without ever...
Thousands of Borrowers' Data Exposed from ENCollect Debt Collection Service
An ElasticSearch server instance that was left open on the Internet without a password contained sensitive financial information about loans from Indian and African financial services. The leak, which was discovered by researchers from information security company UpGuard, amounted to 5.8GB and...
India’s New Super App Has a Privacy Problem
Tata Neu is the country’s latest do-everything app. When users signed up, their personal information was already there...
US healthcare billing services group hacked, affecting at least half a million individuals
According to the US Department of Health and Human Services, Adaptive Health Integrations AHI, a healthcare software and billing services firm in North Dakota, suffered a data breach that affected more than half a million individuals. According to the firm, the breach occurred in mid-October last...
Store XSS
Description Phishing and stealing users through vulnerabilities and accessing users' personal information Proof of Concept POST /admin/enhavo/article/article/update/5?viewid=6 HTTP/1.1 Host: demo.enhavo.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:56.0 Gecko/20100101 Firefox/56.0...
You Can Now Ask Google to Remove Your Phone Number, Email or Address from Search Results
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the...
UniverSIS UniverSIS-API SQL Injection Vulnerability
UniverSIS UniverSIS-API is a student information system architecture interface. A remote attacker could use this vulnerability to retrieve personal information or change grades by sending a crafted SQL statement...
CVE-2022-29603
A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint such as /api/students/me/messages/ to, for example, retrieve personal...
Sql injection
A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint such as /api/students/me/messages/ to, for example, retrieve personal...
CVE-2022-29603
A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint such as /api/students/me/messages/ to, for example, retrieve personal...
CVE-2022-29603
A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint such as /api/students/me/messages/ to, for example, retrieve personal...
PT-2022-19722
Name of the Vulnerable Software and Affected Versions UniverSIS-API versions through 1.2.1 Description A SQL Injection issue exists, allowing a remote authenticated attacker to send crafted SQL statements to vulnerable API endpoints, such as /api/students/me/messages/, via the select parameter...
CVE-2022-29603: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint such as /api/students/me/messages/ to, for example, retrieve personal...
CVE-2022-1054
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and emai...