Joomla! 4.2.7 Unauthenticated Information Disclosure Exploit

!/usr/bin/env ruby Exploit Title: Joomla! = 4.2.8 References: - https://nsfocusglobal.com/joomla-unauthorized-access-vulnerability-cve-2023-23752-notice/ - https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html -...

PT-2023-19025 · Apple · Macos Ventura +3

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 macOS Monterey versions prior to 12.6.4 macOS Big Sur versions prior to 11.7.5 Description: A privacy issue was addressed with improved private data redaction for log entries, which may allow an app to access...

Apple tvOS 安全漏洞

Apple tvOS is an operating system for smart TVs from Apple. A security vulnerability exists in Apple tvOS, which stems from an application that may be able to access sensitive user data...

Apple iOS 和 iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and iPadOS, which arises from applications that may be able to access sensiti...

OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident

OpenAI on Friday disclosed that a bug in the Redis open source library was responsible for the exposure of other users' personal information and chat titles in the upstart's ChatGPT service earlier this week. The glitch, which came to light on March 20, 2023, enabled certain users to view brief...

NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle

Exploit Title: NVFLARE 2.1.4 - Unsafe Deserialization due to Pickle Exploit Author: Elias Hohl Google Dork: N/A Date: 2022-06-21 Vendor Homepage: https://www.nvidia.com Software Link: https://github.com/NVIDIA/NVFlare Version: 2.1.4 Tested on: Ubuntu 20.04 CVE : CVE-2022-34668...

CVE-2023-1584

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provide...

The vulnerability of the software for programming Mitsubishi Electric GX Works3, related to the possibility of using strictly encrypted user data, allows a intruder to gain access to protected information.

The vulnerability of the software for programming Mitsubishi Electric GX Works3 relates to the possibility of using strictly encrypted user data. Exploiting this vulnerability can allow a malicious actor to gain access to protected information...

PT-2023-15191 · Blockonomics · Blockonomics Wordpress Bitcoin Payments

Name of the Vulnerable Software and Affected Versions: Blockonomics WordPress Bitcoin Payments – Blockonomics plugin versions = 3.5.7 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Ibexa Ezplatform-Graphql

CVE-2022-41876 - eZ Platform user information disclosure A vu...

PT-2023-15415 · Unknown · Mickael Austoni Map Multi Marker

Name of the Vulnerable Software and Affected Versions: Mickael Austoni Map Multi Marker plugin versions = 3.2.1 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially allowing them to steal user...

Facebook illegally processed user data, says court

The Amsterdam court has ruled that Facebook illegally processed user data in a case started by the Dutch Data Privacy Stichting DPS, a foundation that acts on behalf of victims of privacy violations in the Netherlands. According to the ruling, Facebook used personal data for advertising purposes ...

PT-2023-21567 · Docker · Play With Docker

Name of the Vulnerable Software and Affected Versions: Play With Docker versions 0.0.2 and prior Description: Play With Docker is a browser-based Docker playground. The issue arises from incorrect CORS configuration, allowing an attacker to bypass the CORS policy by setting the origin header in a...

CVE-2020-4927

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

Code injection

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

CVE-2020-4927 IBM Spectrum Scale information disclosure

A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force ID: 191695...

Authorization

An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems ST-PI - versions 20881700, 20081710, 740, can use a vulnerable interface to execute an application function to perform actions which they...

Online Food Ordering System 跨站请求伪造漏洞

Online Food Ordering System is an online food ordering system by Carlo Montero, an individual developer. A security vulnerability exists in Online Food Ordering System version 1.0, which stems from a cross-site request forgery CSRF vulnerability. The vulnerability can be exploited by an attacker ...

CSV Injection in CSV files generated by the backend

1 login in https://demo.limesurvey.org/index.php 2 the demo admin create a user with name "=1+cmd|'/C calc'!A0". 4 other users login and download all the users' data as csv. 5 other users open the csv file with execl in windows, notice that choose ";" as separator as. 6 we can see that the...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale which could allow unauthorized access to user data or injection of arbitrary data in the communication protocol (CVE-2020-4927)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale which could allow unauthorized access to user data or injection of arbitrary data in the communication protocol . This vulnerability only affects Spectrum Scale clusters that host file systems. Clusters that...