Facebook to Pay $5 Billion Fine to Settle FTC Privacy Investigation

After months of negotiations, the United States Federal Trade Commission FTC has approved a record $5 billion settlement with Facebook over its privacy investigation into the Cambridge Analytica scandal. The settlement will put an end to a wide-ranging probe that began more than a year ago and...

MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting

Exploit Title: MyT Project Management - Userusername Stored Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://manageyourteam.net/index.html Software Link: https://sourceforge.net/projects/myt/files/latest/download Version: 1.5.1 Category: Webapps Tested o...

Security Bulletin: IBM QRadar SIEM is vulnerable to an Information exposure (CVE-2019-4054)

Summary IBM QRadar SIEM could disclose potentially sensitive information about users during content export. Vulnerability Details CVEID: CVE-2019-4054 Description: IBM QRadar could allow a local user to obtain sensitive information when exporting content that could aid an attacker in further...

Zhucheng City Three Swords Network Media Co., Ltd. online shopping mall web system has xss vulnerability

Zhucheng City Three Swords Network Media Co., Ltd. is an Internet web application development company, which has built online shopping mall web systems for many customers. Zhucheng City Three Swords Network Media Co., Ltd. online shopping web system has xss vulnerability, the attacker can embed...

CVE-2019-13239

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...

Related vulnerabilities have now been patched: the Orvibo smart home devices disclosure of user information-bug warning-the black bar safety net

From Orvibo aspect to understand, this relates to the information disclosure of the security vulnerability has now been fixed, and the user information of the protection level, at the same time they also want and professional information security research team into cooperation with the protection...

agrupamento-fajoes.pt Cross Site Scripting vulnerability

Security Researcher ZeroNameless Helped patch 29 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting agrupamento-fajoes.pt website and its users. Following coordinated and responsible...

CVE-2019-4382

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...

PT-2019-17050 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows an unauthorized user to obtain sensitive information about system users by using specially crafted HTTP requests. Recommendations: For versions 5.0.0.0 through...

Sign in with Apple

What's in a Login Button? All you need to know about the new "Sign in with Apple" For Akamai Identity Cloud, we intend to support our clients that wish to implement "Sign in with Apple" just like we do for Facebook, Google, Instagram, Twitter, LinkedIn and about 30 other Identity Providers. If yo...

dinosaurprotectiongroup.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-863836 Security Researcher CoderYounes Helped patch 1033 vulnerabilities Received 5 Coordinated Disclosure badges Received 8 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting...

Insecure Deletion

github.com/pydio/cells is vulnerable to insecure deletion. User data is not securely deleted. A new user created with the same user ID as the deleted user will be able to restore the deleted user's data...

Pydio Cells Information Disclosure Vulnerability (CNVD-2019-21234)

Pydio Cells is a transition application for managing files on a Pydio Cells 1.2.X server. An information disclosure vulnerability exists in versions of Pydio Cells prior to 1.5.0 that stems from Pydio Cells failing to completely delete a user's data when deleting that user, which can be exploited...

CVE-2019-12902

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

Input validation

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

CVE-2019-12902

Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...

CVE-2019-11233

EXCELLENT INFOTEK BiYan v1.57 v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGINID element to the auth/main/asp/checkuserlogininfo.aspx URI, and then reading the response, as demonstrated by the KWEMAIL or KWTEL field...

Open-Xchange (OX) AppSuite Improper Access Control Vulnerability (Bug ID 61315)

Open-Xchange OX AppSuite is prone to an improper access control vulnerability. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Amazon Linux 2 : thunderbird (ALAS-2019-1229)

Mozilla: Buffer overflow in WebGL bufferdata on Linux CVE-2019-11693 Mozilla: Use-after-free in XMLHttpRequest CVE-2019-11691 Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulti...

CVE-2019-9880

WPGraphQL 0.2.3 (WordPress) exposes an unauthenticated information-disclosure via the RootQuery for “users,” allowing retrieval of all WordPress users’ email addresses, usernames, and roles. This vulnerability stems from inadequate access controls in the WPGraphQL plugin, enabling an attacker to ...