6663 matches found
MISP 安全漏洞
MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP versions prior to 2.4.172 that stems from...
The vulnerability of the CORS mechanism implementation in Google Chrome browsers allows a hacker to gain access to confidential data.
The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to data leaks from various sources. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...
Software company accused of illegally profiling millions of mobile phone users
A digital rights and privacy organization has filed a complaint against software company TeleSign for gathering and selling information on millions of mobile phone users. The organization that filed the complaint is nyob. nyob is an Austrian based digital right organization that focusses on...
June 27, 2023—KB5027303 (OS Build 22621.1928) Preview
None None...
Key Network Questions
I wrote this on 7 December 2018 but never published it until today. The following are the "key network questions" which "would answer many key questions about a network, without having to access a third party log repository. This data is derived from mining Zeek log data as it is created, rather...
Generative-AI apps & ChatGPT: Potential risks and mitigation strategies
Losing sleep over Generative-AI apps? You're not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Contin...
PT-2023-17688 · Cloud Foundry · Cloud Foundry Nfs Volume +2
Name of the Vulnerable Software and Affected Versions: Cloud Foundry Notifications versions prior to 63 Cloud Foundry SMB-volume release versions prior to 3.1.19 Cloud Foundry cf-nfs-volume release versions prior to 5.0.27 Cloud Foundry cf-nfs-volume release versions prior to 7.1.19 Description:...
go-restful: Authorization Bypass Through User-Controlled Key
A flaw was found in CORS Filter feature from the go-restful package. When a user inputs a domain which is in AllowedDomains, all domains starting with the same pattern are accepted. This issue could allow an attacker to break the CORS policy by allowing any page to make requests and retrieve data...
CVE-2023-32749
Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all...
Microsoft to Pay $20 Million Penalty for Illegally Collecting Kids' Data on Xbox
Microsoft has agreed to pay a penalty of $20 million to settle U.S. Federal Trade Commission FTC charges that the company illegally collected and retained the data of children who signed up to use its Xbox video game console without their parents' knowledge or consent. "Our proposed order makes i...
Satacom delivers browser extension that steals cryptocurrency
Satacom downloader, also known as LegionLoader, is a renowned malware family that emerged in 2019. It is known to use the technique of querying DNS servers to obtain the base64-encoded URL in order to receive the next stage of another malware family currently distributed by Satacom. The Satacom...
we can still send the photo as greeting card even the albums is locked
1 admin create a album and upload a photo 2 member-1 login and send the photo as greeting card to member-2 3 member-1 use burpsuite hijack the request, which can be like POST /admprogram/modules/ecards/ecardsend.php HTTP/1.1...
DRUPAL-CONTRIB-2023-018
This module provides social media share & follow buttons. The module doesn't sufficiently check access to a node when retrieving the label of an AddToAny block. This vulnerability is mitigated by the fact it requires the node ID to be passed via the route, requiring another module or specific...
Pydio Cells 4.1.2 - Unauthorised Role Assignments
Exploit Title: Pydio Cells 4.1.2 - Unauthorised Role Assignments Affected Versions: 4.1.2 and earlier versions Fixed Versions: 4.2.0, 4.1.3, 3.0.12 Vulnerability Type: Privilege Escalation Security Risk: high Vendor URL: https://pydio.com/ Vendor Status: notified Advisory URL:...
Pydio Cells 4.1.2 - Cross-Site Scripting via File Download Vulnerability
Exploit Title: Pydio Cells 4.1.2 - Cross-Site Scripting XSS via File Download Affected Versions: 4.1.2 and earlier versions Fixed Versions: 4.2.0, 4.1.3, 3.0.12 Vulnerability Type: Cross-Site Scripting Security Risk: high Vendor URL: https://pydio.com/ Vendor Status: notified Advisory URL:...
Keyboard and typing issue on shared screen of Microsoft Teams
When a host opens Teams on a Windows VDA and starts a meeting with an invitee from a Windows environment the invitee can use a physical Windows machine, a remote Windows by RDP, or a Windows VDA, after the host shares the screen with the invitee and gives control to the invitee, the host from the...
Pydio Cells 4.1.2 - Unauthorised Role Assignments Vulnerability
Exploit Title: Pydio Cells 4.1.2 - Unauthorised Role Assignments Affected Versions: 4.1.2 and earlier versions Fixed Versions: 4.2.0, 4.1.3, 3.0.12 Vulnerability Type: Privilege Escalation Security Risk: high Vendor URL: https://pydio.com/ Vendor Status: notified Advisory URL:...
CVE-2023-33741
Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device...
