8033 matches found
Apple macOS Ventura 安全漏洞
Apple macOS Ventura is an operating system from Apple USA Inc. A security vulnerability exists in Apple macOS Ventura version 13.7.7, which stems from a logic issue that results in an insufficient restriction that could cause an application to access sensitive user data. q...
The vulnerability of the software solution for optimizing operations in SAP for Oil & Gas lies in the lack of authentication procedures, which allow unauthorized users to gain access and delete user data.
The vulnerability of the software solution for optimizing operations in SAP for Oil & Gas is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and delete user data remotely...
CVE-2025-43313: Improper Access Control
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access sensitive user data...
CVE-2025-40773
A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request. Successful exploitation...
CVE-2025-40773
A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications contains a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request. Successful exploitation...
PT-2025-41885
Name of the Vulnerable Software and Affected Versions SiPass integrated versions prior to 3.0 Description A broken access control issue exists in SiPass integrated server applications. The authorization mechanism does not have enough server-side checks, which allows an attacker to execute a...
Siemens SiPass integrated 安全漏洞
Siemens SiPass Integrated is a powerful and extremely flexible access control system from Siemens, Germany. A security vulnerability exists in Siemens SiPass integrated prior to version V3.0, which stems from improper access control and could allow an attacker to manipulate other users' data...
Nextcloud: BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
Summary The Out-of-Office OOO API endpoints at /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId and /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId/now suffer from a Broken Object Level Authorization BOLA vulnerability. Any authenticated user can retrieve the out-of-office data of any other user by...
CVE-2025-62292
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the list function in UserInfoController.java. An attacker can access sensitive user information by sending unauthorized requests remotely. Remediation There is no fixed version for...
Millions of (very) private chats exposed by two AI companion apps
Cybernews discovered how two AI companion apps, Chattee Chat and GiMe Chat, exposed millions of intimate conversations from over 400,000 users. This is not the first time we have to write about AI "girlfriends" exposing their secrets—and it probably won't be the last. This latest incident is a...
CVE-2025-21050: Undefined Security Weakness
Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...
CVE-2025-36225
CVE-2025-36225 concerns IBM Aspera Faspex information disclosure: Aspera Faspex versions 5.0.0–5.0.13.1 may disclose sensitive user information to an authenticated user due to an observable discrepancy in returned data. The IBM advisory (IBM Aspera Faspex security bulletin) lists this CVE among m...
CVE-2025-27236
A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to...
Opencast 跨站脚本漏洞
Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. Opencast suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied dat...
Discord warns users after data stolen in third-party breach
Popular social platform Discord has suffered a data breach—though technically, it wasn’t Discord itself that was hacked. A third-party customer support provider was compromised, allowing attackers to access Discord’s user data. Either way, it’s Discord users who feel the impact. The breach, which...
EUVD-2021-21889
Malware in sbrugna...
EUVD-2017-14723
Malware in sbrugna...