720 matches found
Despite COVID-19 pandemic, Imperva reports number of vulnerabilities decreased in 2020
Imperva’s report, The State of Vulnerabilities in 2020 has revealed that unlike in previous years, researchers observed a fall in the number of vulnerabilities last year, even as businesses were compelled to accelerate digital transformation processes due to the COVID-19 pandemic. Vulnerabilities...
U.S. Dept Of Defense: CRXDE Lite/CRX is on ██████ exposed that leads to PII disclosure
hi team , i found that aem is running on ████████ and CRXDE Lite/CRX is exposed to unauthenticated user that can lead to information disclosure POC ==== 1-visit https://██████//██████████ 2-go to query and search for admin then execute 3-go to this endpoint to retrieve the information...
Automating and operationalizing data protection with Dataguise and Microsoft Information Protection
This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. In technical literature, the terms data discovery, classification, and tagging are sometimes used interchangeably, but there are real differences in what they actually mean—and each...
Automating and operationalizing data protection with Dataguise and Microsoft Information Protection
This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. In technical literature, the terms data discovery, classification, and tagging are sometimes used interchangeably, but there are real differences in what they actually mean—and each...
Shopify: [h1-2102] Improper Access Control at https://shopify.plus/[id]/users/api in operation UpdateOrganizationUserRole
Summary: There is an access control issue that happens when a Shopify Plus admin tries to assign a role to a user in another organisation. While the response shows an error message, an email is sent to the shop admin with the first name, last name and email address of the user. Steps To Reproduce...
Elementor Contact Form DB < 1.6 - Unauthenticated & Unauthorised Form Submissions Export
The sbelemcfddownloadcsv function, registered as an admininit hook does not have capability and CSRF checks, allowing unauthenticated attackers to download arbitrary form submissions as a CSV. The data will include PII such as email addresses. A CSRF check was added, but no capability one, so the...
Ethical Hackers Breach U.N., Access 100,000 Private Records
Security researchers successfully hacked the United Nations, accessing user credentials and personally identifiable information PII–including more than 100,000 private employee and project records—before informing the U.N. about the problem through the organization’s vulnerability disclosure...
U.S. Dept Of Defense: Bypassed a fix to gain access to PII of more than 100 Officers
Summary: Hey team I hope this report finds you well and you're having a great day in these difficult times ; While doing my Recon I have found out that https://www.███/ is leaking PII of many Officers Severity according to me- Critical Step-by-step Reproduction Instructions 1. Go to...
Topcoder: IDOR at https://fast.trychameleon.com/observe/v2/profiles/ via uid parameter discloses users' PII data
Summary: Hello, A API on apps.topcoder.com/forums/ exposes the email of any user on topcoder.com and some PIIs name, surname, id. Steps To Reproduce: 1 Create a profile at topcoder.com 2 Go to apps.topcoder.com/forums and login forum 3 Entery any topic example:...
U.S. Dept Of Defense: PII Leak of ████████ Personal at https://www.█████████
Hello DoD Team, Summary: PII Leakage of approx 1000 personal is being disclosed through the pdf at https://www.████████which had been uploaded at the 7th of October, this includes Personal phone number and email address. Description: The list presented at the "████████" contains personal info suc...
Spotify resets some user logins after hacker database found floating online
A team of researchers working for vpnMentor has found a treasure trove in the form of an unsecured Elasticsearch database containing over 380 million records. The trove contained login credentials and other data belonging to Spotify users. So whats Spotify doing leaving its user data hanging arou...
Safeguard Identity Data at the Source
Leverage Identity Cloud's built-in tooling to safeguard your customers' data from unnecessary exposure When your customers create an account on your website or application, they are entrusting their valuable information with you in order to establish a relationship. To maintain that relationship,...
Acronis: Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakage
Blind XSS was possible on partners.acronis.com Tier 3 via several contact form fields. We have seen no signs of the exploitation of this vulnerability...
Client-Side Protection is Key to Web Application Security
The Open Web Application Security Project OWASP Foundation defines script attacks as a "type of injection in which malicious scripts are injected into otherwise benign and trusted websites."1 From the perspective of the user, malicious code is coming from trusted websites. Recently popularized by...
$100M Botnet Scheme Lands Cybercriminal 8 Years in Jail
Authorities have sentenced a hacker to eight years in prison for trafficking stolen personally identifiable information PII and online banking credentials resulting in losses totaling over $100 million. Aleksandr Brovko, 36, formerly of the Czech Republic, pleaded guilty in February to conspiracy...
lka.spbgasu.ru GDPR PII Exposure vulnerability OBB-1470000
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
jira.globalprocessing.ae GDPR PII Exposure vulnerability OBB-1467826
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
jira.deiser.com GDPR PII Exposure vulnerability OBB-1467824
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
jira.platform.mnscorp.net GDPR PII Exposure vulnerability OBB-1467823
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
munchie.co.za GDPR PII Exposure vulnerability OBB-1447735
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...