23andMe blames “negligent” breach victims, says it’s their own fault

In a surprising move, in a letter to legal representatives of victims of the recent 23andMe data breach, the company has laid the blame at the feet of victims themselves. 23andMe even goes as far as to claim that this wasn’t a data breach at 23andMe at all. The reasoning: “… unauthorized actors...

CVE-2021-40367

A vulnerability has been identified in syngo fastView All versions. The affected application lacks proper validation of user-supplied data when parsing DICOM files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to...

PT-2024-15065 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions up to, and including, 3.4.8 Description: The issue allows authenticated attackers with contributor access and above to extract sensitive data, including user emails, password hashes, and usernames, via th...

CVE-2023-50342

HCL DRYiCE MyXalytics is impacted by an Insecure Direct Object Reference IDOR vulnerability. A user can obtain certain details about another user as a result of improper access control...

WP-Members Membership Plugin < 3.4.9 - Contributor+ Sensitive Information Exposure

Description The plugin is vulnerable to Sensitive Information Exposure via the wpmemfield shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more...

HCL Technologies DRYiCE MyXalytics Security Breach

HCL Technologies DRYiCE MyXalytics is a unified reporting and dashboard product from HCL Technologies, USA. A security vulnerability exists in HCL Technologies DRYiCE MyXalytics that stems from a client administrator user having access to certain API endpoints that allow access to sensitive...

CVE-2023-6339

Google Nest WiFi Pro root code-execution & user-data compromise...

Remote code execution

Google Nest WiFi Pro root code-execution & user-data compromise...

CVE-2023-6339

CVE-2023-6339 affects Google Nest WiFi Pro. The vulnerability allows remote root code execution and user-data compromise over the network with low attack complexity and no privileges required. Impacted by confidentiality, integrity, and availability being high. CVSS metrics show a critical risk (...

CVE-2023-6339 Google Nest WiFi Pro root code-execution & user-data compromise

Google Nest WiFi Pro root code-execution & user-data compromise...

PT-2024-14935 · Google · Google Nest Wifi Pro

Name of the Vulnerable Software and Affected Versions: Google Nest WiFi Pro affected versions not specified Description: A severe issue has been disclosed for Google Nest WiFi Pro, allowing for root code-execution and user-data compromise. The estimated number of potentially affected devices...

Google Nest Security Breach

Google Nest is a smart home product from Google, Inc. in the United States. Google Nest has a security vulnerability that stems from root code execution and user data leakage...

SeaCMS Cross-Site Scripting Vulnerability (CNVD-2024-06149)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS v12.8, which stems from the lack of effective filtering and escaping of user-supplied da...

CVE-2023-50448

In ActiveAdmin aka Active Admin before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data that belongs to another user by making CSV export requests at certain specific times...

IBM Aspera Console Cross-Site Scripting Vulnerability

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Aspera Console that stems from the application's lack of effective filtering and escaping of user-supplied...

RingGo, ParkMobile Owner EasyPark Suffers Data Breach, User Data Stolen

By Waqas ParkMobile, a globally-used parking app, is the same platform that suffered a massive data breach in 2021 when hackers leaked the data of 21 million customers. This is a post from HackRead.com Read the original post: RingGo, ParkMobile Owner EasyPark Suffers Data Breach, User Data Stolen...

404 Solution < 2.33.1 - Sensitive Information Exposure

Description The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.33.0. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data...

The vulnerability of the Nagios XI monitoring tool lies in its use of strictly encrypted user data. This allows a malicious actor to gain access to read, modify, or delete data, execute arbitrary code, or trigger a service failure.

The vulnerability of the Nagios XI monitoring tool is related to the use of strictly encrypted user data. Exploiting this vulnerability allows an attacker to gain access to read, modify, or delete data, execute arbitrary code, or trigger a service failure...

RPCMS Cross-Site Scripting Vulnerability (CNVD-2024-01190)

RPCMS is a software application, a web CMS system. A cross-site scripting vulnerability exists in RPCMS v3.5.5, which stems from the lack of effective filtering and escaping of user-supplied data in the component /logs/dopost.html, and can be exploited by an attacker to execute arbitrary Web scri...

Kubeflow Cross-Site Scripting Vulnerability

Kubeflow is a cloud-native platform open-sourced by Kubeflow. Kubeflow cross-site scripting vulnerability , the vulnerability stems from the source parameter of the user-supplied data lack of effective filtering and escaping , an attacker can use this vulnerability to hijack the account through...