Clearview AI banned from selling facial recognition data in the US

Clearview AI, a facial recognition software and surveillance company, is permanently banned from selling its faceprint database within the United States. The company also cannot sell its database to state and law enforcement entities in Illinois for five years. This is a historic win for the...

PT-2022-3410 · Unknown +5 · Eventsource +5

Name of the Vulnerable Software and Affected Versions: eventsource/eventsource versions prior to 2.0.2 Description: The issue is related to insufficient protection of sensitive data, allowing a remote attacker to gain unauthorized access to protected information. This is due to the improper remov...

Canon printer owners: Be careful of bogus driver download sites

Think of all the really common, very mundane things you search for of a tech nature. Drivers. Scanners. Printers. A broken photocopier. USB sticks not recognised. Activating a streaming service which refuses to play ball. Some of the above have many issues already with bogus search engine results...

webkitgtk: A malicious website may exfiltrate data cross-origin

A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information...

WordPress plugin Ultimate Member 输入验证错误漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The Ultimate Member plugin is a plugin used to create membership sites or online communities. The vulnerability redirects users to malicious websites for phishing and other attacks...

Airdrop phishing: what is it, and how is my cryptocurrency at risk?

Airdrop phishing is a really popular tactic at the moment. It emerged alongside the explosion of Web3/NFT/cryptocurrency popularity, and ensures scammers get a slice of the money pie. You may well have heard the term in passing, and wondered what an Airdrop is. Is your iPhone about to be Airdrop...

Ukraine government and pro-Ukrainian sites hit by DDoS attacks

The Computer Emergency Response Team in Ukraine CERT-UA has announced that Ukraine government web portals and pro-Ukraine sites are subjected to ongoing DDoS distributed denial of service attacks. They dont currently know who is behind these attacks. The attack involves injecting a malicious...

WordPress Hermit plugin跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress Hermit plugin cross-site scripting vulnerability, no details of the vulnerability are currently...

CVE-2021-4225 SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload

The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovere...

WordPress plugin English WordPress Admin 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress English WordPress Admin plugin version 1.5.2 has a redirect vulnerability, which can be...

Oracle WebCenter Sites (Apr 2022 CPU)

The 12.2.1.3.0 and 12.2.1.4.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites Cryptacular...

WordPress VikBooking Hotel Booking Engine ＆ PMS plugin信息泄露漏洞

WordPress and WordPress plugin are products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. WordPress VikBooking Hotel...

PT-2022-13753 · Mcafee · Skyhigh Swg

Name of the Vulnerable Software and Affected Versions: Skyhigh SWG versions 7.x prior to 7.8.2.31 Skyhigh SWG versions 8.x prior to 8.2.27 Skyhigh SWG versions 9.x prior to 9.2.20 Skyhigh SWG versions 10.x prior to 10.2.9 Skyhigh SWG versions 11.x prior to 11.1.3 Description: A URL redirection...

McAfee Skyhigh Secure Web Gateway 输入验证错误漏洞

McAfee Skyhigh Secure Web Gateway McAfee Skyhigh SWG is a family of security gateways from McAfee Inc. in the United States. The McAfee Skyhigh Secure Web Gateway suffers from an input validation error vulnerability that stems from a faulty application redirection response. A remote attacker coul...

CVE-2022-1019

Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file...

CVE-2022-26595

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI...

Code injection

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

CVE-2022-28215

SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information...

PT-2022-2902 · Microsoft · Ms Lync +1

Name of the Vulnerable Software and Affected Versions: Skype for Business Server affected versions not specified Description: The vulnerability is related to a lack of protection for service data in Skype for Business Server, which can allow a remote attacker to gain unauthorized access to...