Online Birth Certificate Management System 1.0 Insecure Direct Object Reference

Exploit Title: Online Birth Certificate Management System - Insecure Direct Object Reference IDOR Google Dork: N/A Date: 2022-9-27 Exploit Author: yousef alraddadi - https://twitter.com/y0usef11 Vendor Homepage:...

PT-2022-37302 · Exiv2 · Exiv2

Name of the Vulnerable Software and Affected Versions: Exiv2 affected versions not specified Description: The issue is related to a heap buffer overflow error. Technical details about the error include the crash type being a heap-buffer-overflow WRITE and the crash state involving functions such ...

CVE-2022-32849

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, tvOS 15.6, macOS Monterey 12.5, Security Update 2022-005 Catalina. An app may be able to access sensitive user information...

CVE-2022-32880

This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able to access user-sensitive data...

Kiwi Farms breached, user data potentially exposed

The operators of a site known to most observers for being in a recent state of flux have announced a forum breach. Kiwi Farms, which gained a reputation for sophisticated trolling and doxxing, was recently dropped by Cloudflare after a sustained campaign to have the DDoS mitigation and cloud...

A week in security (September 12 – 18)

Last week on Malwarebytes Labs: The North Face hit by credential stuffing attack Facebook engineers aren't sure where all user data is kept 6 patch management best practices for businesses The MSP playbook on deciphering tech promises and shaping security culture Apple puts the password on life...

LastPass Says No User Data Compromised in Cyberattack

By Waqas According to LastPass, threat actor did access its Developer environment but could not compromise sensitive data because of its effective system design and controls. This is a post from HackRead.com Read the original post: LastPass Says No User Data Compromised in Cyberattack...

Cross site request forgery (csrf)

The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to fetch other users' data upon a successful login request...

CVE-2022-36782

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx,...

Authorization

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx,...

CVE-2022-36782 Pal Electronics Systems - Pal Gate Authorization Errors

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx,...

Transtek Mojodat FAM 安全漏洞

Transtek Mojodat FAM is a fixed asset management software from Transtek Lebanon. A security vulnerability exists in Transtek Mojodat FAM Fixed Asset Management version 2.4.6, which originates from a vulnerability that could allow a remote attacker to gain access to other user's data after a...

PT-2022-23621 · Pal Electronics Systems · Palgate

Name of the Vulnerable Software and Affected Versions: Pal Electronics Systems affected versions not specified Description: The issue is an authorization problem in the PalGate device management Android client app, affecting gates of buildings and parking lots controlled by a simple button in any...

The vulnerability of Kubernets Rancher cluster management software, related to unencrypted storage of user data, allows a hacker to escalate their privileges.

The vulnerability of Kubernets Rancher cluster management software is related to the unencrypted storage of user credentials. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...

CVE-2022-36782

Pal Electronics Systems - Pal Gate Authorization Errors. The vulnerability is an authorization problem in PalGate device management android client app. Gates of bulidings and parking lots with a simple button in any smartphone. The API was found after a decompiling and static research using Jadx,...

Glassdoor: XSS in www.glassdoor.com

Summary: Browser: Chrome Affected URL https://www.glassdoor.com/Location/All-Tesla-Office-Locations-E43129.htm?DIFFICULT=%3E%3Csvg%20onload%3d%26%23x00000000061;%26%23x0000000006c%26%23x0000000065%26%23x0000000072%26%23x000000000741%26%230000000000000041;%20%3C%2fscript%20 Steps To Reproduce: 1. ...

PT-2022-24317 · Unknown · Tastyigniter

Name of the Vulnerable Software and Affected Versions: TastyIgniter version 3.5.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload, which is a result of a cross-site scripting XSS vulnerability. This means an attacker can inject malicious...

Sephora Fined $1.2 Million for Breaching CCPA and Selling User Data

By Deeba Ahmed Sephora claims it respects consumer privacy and "strives to be transparent about how their personal information is used" to improve customer experience. This is a post from HackRead.com Read the original post: Sephora Fined $1.2 Million for Breaching CCPA and Selling User Data...

What Are the Top 10 Android Educational Apps That Collect Most User Data?

By Deeba Ahmed HelloTalk, GoogleClassroom, ClassDojo, and Duolingo turned out to be the top 3 educational apps that collect the most user data from Android devices. This is a post from HackRead.com Read the original post: What Are the Top 10 Android Educational Apps That Collect Most User Data?...

PT-2022-23889 · Mdaemon Technologies · Mdaemon Securitygateway For Email Servers

Name of the Vulnerable Software and Affected Versions: MDaemon Technologies SecurityGateway for Email Servers version 8.5.2 Description: The issue is related to Cross Site Scripting XSS and can be exploited via the "Blacklist endpoint". This means that an attacker could potentially inject malicio...