Hoppscotch Browser Extension 安全漏洞

Hoppscotch Browser Extension is an open source browser extension for Hoppscotch. A security vulnerability exists in Hoppscotch Browser Extension versions prior to 0.35, which stems from a vulnerability that allows any site running on a browser with the extension installed to bypass CORS...

PT-2024-29385 · Unknown · Manage Bank Statement Reprocessing Rules

Name of the Vulnerable Software and Affected Versions: Manage Bank Statement ReProcessing Rules affected versions not specified Description: The issue is related to insufficient authorization checks for authenticated users, leading to potential escalation of privileges. An attacker can exploit th...

HCL DRYiCE Lucy 安全漏洞

HCL Technologies HCL DRYiCE Lucy is an AI-powered virtual assistant from HCL Technologies, USA. A security vulnerability exists in HCL DRYiCE Lucy that stems from vulnerability to CORS misconfiguration...

Matrix 日志信息泄露漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. A log message disclosure vulnerability exists in Matrix versions prior to 0.7.1 that stems from key sharing between user devices and providing redundant copies in the event that all devices are lost...

Huawei HarmonyOS 安全漏洞

Huawei EMUI and Huawei HarmonyOS are both products of Huawei, a mobile operating system based on Android, and Huawei HarmonyOS, a distributed operating system developed by Huawei for the whole scenario, aiming at realizing intelligent interconnection and resource sharing among people, devices, an...

CVE-2024-32990

Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability...

CVE-2024-32990

CVE-2024-32990 describes a permission verification vulnerability in the system sharing pop-up module affecting Huawei HarmonyOS/Huawei EMUI. The underlying issue is insufficient permission checks in that module, with impact noted as availability loss upon successful exploitation. Connected source...

CVE-2024-32990

Permission verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability...

CVE-2024-32989

Insufficient verification vulnerability in the system sharing pop-up module Impact: Successful exploitation of this vulnerability will affect availability...

PT-2024-25038 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: System sharing pop-up module affected versions not specified Description: The issue is related to a permission verification vulnerability in the system sharing pop-up module. Successful exploitation of this vulnerability will affect...

PT-2024-25036 · Huawei · Huawei System Sharing Pop-Up Module

Name of the Vulnerable Software and Affected Versions: Huawei System Sharing Pop-Up Module affected versions not specified Description: The issue is related to an insufficient verification vulnerability in the system sharing pop-up module. Successful exploitation of this vulnerability will affect...

CVE-2023-37526

The CVE-2023-37526 entry concerns HCL DRYiCE Lucy (now AEX). A CORS misconfiguration in the mobile app could allow unauthorized access to application resources from any web domain and enable cache poisoning, per sources in NVD/CVE records. The root cause is a CORS misconfiguration in the app, wit...

CVE-2023-37526 HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) Vulnerability

HCL DRYiCE Lucy now AEX is affected by a Cross Origin Resource Sharing CORS vulnerability. The mobile app is vulnerable to a CORS misconfiguration which could potentially allow unauthorized access to the application resources from any web domain and enable cache poisoning attacks...

How to Create Collaboration and Shared Goals with IT and Security Teams

In today’s ITSM landscape, merging IT operations and security practices is no longer “ideal”, but imperative. According to a recent Gartner® Board of Directors Survey 1, 88% of respondents indicated that their organization perceives cybersecurity as a business risk. This was up from 58% in 2016,...

Popular Android Apps Like Xiaomi, WPS Office Vulnerable to File Overwrite Flaw

Several popular Android applications available in Google Play Store are susceptible to a path traversal-affiliated vulnerability codenamed the Dirty Stream attack that could be exploited by a malicious app to overwrite arbitrary files in the vulnerable app's home directory. "The implications of...

WordPress plugin Social Sharing 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

“Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps

Microsoft discovered a path traversal-affiliated vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application’s home directory. The implications of this vulnerability pattern include arbitrary code...

kernel: smb: client: fix missed ses refcounting

A use-after-free vulnerability was found in the Linux kernel's SMB client implementation. When handling SMB sessions with DFS Distributed File System root sessions, the code fails to properly increment the reference count for both the session and its dfsrootses. This can cause the dfsrootses to b...

FCC Fines Major U.S. Wireless Carriers for Selling Customer Location Data

The U.S. Federal Communications Commission FCC today levied fines totaling nearly $200 million against the four major carriers -- including AT&T, Sprint, T-Mobile and Verizon -- for illegally sharing access to customers location information without consent. The fines mark the culmination of a mor...

CVE-2024-2159

The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...