SUSE CVE-2015-5179

FreeIPA might display user data improperly via vectors involving non-printable characters...

SUSE CVE-2017-8439

Kibana version 5.4.0 was affected by a Cross Site Scripting XSS bug in the Time Series Visual Builder. This bug could allow an attacker to obtain sensitive information from Kibana users...

SUSE CVE-2017-1000395

Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/username/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote...

SUSE CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

SUSE CVE-2021-28374

The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's...

SUSE CVE-2022-31743

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox 101...

SUSE CVE-2022-45143

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

The vulnerability of the Video Driver in Linux kernel allows a local attacker to trigger a system failure.

The vulnerability of the Video Driver in Linux operating systems is related to insufficient checking of user data. Exploiting this vulnerability can allow an attacker to cause service failures...

SA44328 - 2019-12: Out-Of-Cycle Advisory: Vulnerability Could Allow Attackers to Sniff or Hijack VPN Connections (CVE-2019-14899)

Last Modified Date Aug 23, 2026 9:03:27 PM...

VulnCheck KEV: CVE-2023-23522

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Ventura 13.2.1. An app may be able to observe unprotected user data...

Apple macOS Ventura 安全漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura. An attacker could exploit this vulnerability to obtain sensitive user information...

Malicious Package

Overview s3transfere is a malicious package. It attempts typosquatting popular packages. The malicious script is base64 obfuscated located in init.py file and tries to steal the current username, platform and IP information and send them to a remote host. Malicious behavior python import getpass...

Malicious Package

Overview s3transferss is a malicious package. It attempts typosquatting popular packages. The malicious script is base64 obfuscated located in init.py file and tries to steal the current username, platform and IP information and send them to a remote host. Malicious behavior python import getpass...

Malicious Package

Overview certefi is a malicious package. It attempts typosquatting popular packages. The malicious script is base64 obfuscated located in init.py file and tries to steal the current username, platform and IP information and send them to a remote host. Malicious behavior python import getpass impo...

Malicious Package

Overview s3trnasfer is a malicious package. It attempts typosquatting popular packages. The malicious script is base64 obfuscated located in init.py file and tries to steal the current username, platform and IP information and send them to a remote host. Malicious behavior python import getpass...

Reddit Suffers Security Breach Exposing Internal Documents and Source Code

Popular social news aggregation platform Reddit has disclosed that it was the victim of a security incident that enabled unidentified threat actors to gain unauthorized access to internal documents, code, and some unspecified business systems. The company blamed it on a "sophisticated and...

PT-2023-20158

Name of the Vulnerable Software and Affected Versions DataHub affected versions not specified Description The issue concerns the AuthServiceClient in DataHub, which is responsible for managing accounts and authentication. It crafts JSON strings using format strings with user-controlled data,...

CVE-2023-24148

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function...

Google Fi User Data Breached Through T-Mobile Hack

By Deeba Ahmed Google Fi customers are impacted by the recent T-Mobile breach, as Fi relies on T-Mobile and US Cellular for connectivity. This is a post from HackRead.com Read the original post: Google Fi User Data Breached Through T-Mobile Hack...

GHSA-XRH7-M5PP-39R6 XSS Attack with Express API

Impact XSS attack - anyone using the Express API is impacted Patches The problem has been resolved. Users should upgrade to version 2.0.0. Workarounds Don't pass user supplied data directly to res.renderFile. References Are there any links users can visit to find out more? See...