PT-2022-18010

Name of the Vulnerable Software and Affected Versions macOS versions prior to 12.4 Description This issue was addressed with improved checks. A plug-in may be able to inherit the application's permissions and access user data. Recommendations For versions prior to 12.4, update to macOS Monterey...

PT-2022-18018 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.4 Description: The issue concerns the handling of environment variables, which has been addressed with improved validation. A user may be able to view sensitive user information due to this issue. Recommendations: F...

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins

Jenkins before versions 2.44 and 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

Moodle Exposes Sensitive User Information

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section...

Misconfigured ElasticSearch Servers Exposed 579 GB of Users’ Website Activity

By Waqas In total, two misconfigured ElasticSearch servers belonging to an unknown organization exposed 359,019,902 359 million records that were… This is a post from HackRead.com Read the original post: Misconfigured ElasticSearch Servers Exposed 579 GB of Users’ Website Activity...

Sysaid Technologies SysAid security vulnerabilities

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. Sysaid Technologies Sysaid suffers from a security vulnerability that stems from faulty access control. An attacker can exploit the vulnerability to receive sensitive data such as server...

CVE-2022-28986

LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references IDOR vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts...

CVE-2022-28986

LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references IDOR vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts...

CVE-2022-29180 Charm vulnerable to server-side request forgery (SSRF)

A vulnerability in which attackers could forge HTTP requests to manipulate the charm data directory to access or delete anything on the server. This has been patched and is available in release v0.12.1. We recommend that all users running self-hosted charm instances update immediately. This...

Unrestricted Upload of File with Dangerous Type in yetiforce-crm

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to...

India to Collect User Data from VPNs, Data Centers, and Cloud Service Providers

By Deeba Ahmed The Indian government recently passed a new law that mandates all internet service providers to collect and store… This is a post from HackRead.com Read the original post: India to Collect User Data from VPNs, Data Centers, and Cloud Service Providers...

VPN Providers Threaten to Quit India Over New Data Law

The country has ordered companies operating VPNs to collect user data and hand it over to officials—but they’re refusing to do so...

Shopware Cross-Site Scripting Vulnerability (CNVD-2022-47472)

Shopware is a suite of open source e-commerce software from the German company Shopware. cross-site scripting vulnerability exists in versions of Shopware prior to 5.7.9, which stems from a lack of filtering and escaping of user data in the plugin. No detailed vulnerability details are available...

Grav Cross-Site Scripting Vulnerability

Grav is a scalable CMS content management system for personal blogs, small content publishing platforms, and single-page product displays. cross-site scripting vulnerabilities exist in versions prior to Grav 1.7.33, which stem from the application's lack of filtering and escaping of user data. An...

PT-2022-19040

Name of the Vulnerable Software and Affected Versions Limbas version 4.3.36.1319 Description The issue is related to Cross Site Scripting XSS, which is a type of attack where an attacker injects malicious scripts into a website, allowing them to steal user data or take control of the user's...

Google's New Safety Section Shows What Data Android Apps Collect About Users

Google on Tuesday officially began rolling out a new "Data safety" section for Android apps on the Play Store to highlight the type of data being collected and shared with third-parties. "Users want to know for what purpose their data is being collected and whether the developer is sharing user...

Booking Calendar < 9.1.1 - PHP Object Injection

The plugin unserializes user data without being validated first, which could allow attackers to perform PHP object injection attack. If a timeline is published, unauthenticated attackers could perform such attack, otherwise any authenticated could. A suitable POP chain, from another plugin for...

Elon Musk’s Twitter Buy Exposes a Privacy Minefield

The social network’s user data and more will soon be at the whims of the world’s richest man. Who’s worried?...

PT-2022-13597

Name of the Vulnerable Software and Affected Versions chatwoot/chatwoot versions prior to 2.5.0 Description The issue is related to Cross-site Scripting XSS - Stored. This means that an attacker can inject malicious scripts into the application, which are then stored and executed by the...

CVE-2022-24865 Improper access control in humhub

HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit eb83de20. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. The...