MTN Group: Information Disclosure Leads To User Data Leak

Information disclosure is when a web application fails to properly protect confidential information, which causes revealing sensitive information or data of the users or anything related to users to any third party. Summary: Am able to get any MTN users data such as FULL NAME, CUSTOMER TYPE AND...

Improper access control could make any user export all user of website

Description A user who has to change their password after logging in can export the website's user data. Proof of Concept Step 1: login to website by admin account and change password of a user. Check the box "Force password change upon next login" and save. Step 2: login to website by the accoun...

Apps removed from Google Play for harvesting user data

Dozens of apps were removed from the Google Play Store after they were found to be harvesting the data of device owners. The code in question—a software development kit SDK—was used inside apps which were downloaded over 10 million times. What happened? A wide range of Android apps were found to...

CVE-2022-0919

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...

Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues PoC As admin, import the below CSV file via Tools Import and export users and customers /wp-admin/tools.php?page=ac...

CVE-2022-27960

Insecure permissions configured in the userid parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitrarily modify users' personal information...

SharkBot Banking Trojan Resurfaces On Google Play Store Hidden Behind 7 New Apps

As many as seven malicious Android apps discovered on the Google Play Store masqueraded as antivirus solutions to deploy a banking trojan called SharkBot. "SharkBot steals credentials and banking information," Check Point researchers Alex Shamshur and Raman Ladutska said in a report shared with T...

Bentley Systems MicroStation buffer error vulnerability

Bentley Systems MicroStation is a Cad software platform for 2D and 3D design and drafting from Bentley Systems, USA. A buffer error vulnerability exists in Bentley MicroStation CONNECT version 10.16.02.034, which originates from a failure to properly validate the length of user-supplied data befo...

Bentley Systems MicroStation buffer error vulnerability

Bentley Systems MicroStation is a Cad software platform for 2D and 3D design and drafting from Bentley Systems, USA. A buffer error vulnerability exists in Bentley MicroStation CONNECT version 10.16.02.034, which originates from a failure to properly validate the length of user-supplied data befo...

IBM Sterling Partner Engagement Manager权限提升漏洞

IBM Sterling Partner Engagement Manager is an automated management tool from IBM Corporation. IBM Sterling Partner Engagement Manager version 6.2.0 contains an elevation of privilege vulnerability that could be exploited by attackers to elevate privileges and perform unexpected operations on othe...

phpIPAM < 1.4.6 Multiple Vulnerabilities

phpIPAM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:phpipam:phpipam"; ifdescription...

PT-2022-7705

Name of the Vulnerable Software and Affected Versions Kyocera Net View affected versions not specified Description The issue concerns an insufficiently protected address book export function in Kyocera Net View, which unintentionally exposes sensitive user information, including usernames and...

Fake Cops Scammed Apple and Meta to Get User Data

Plus: Lapsus$ teens hit with charges, Wyze's security screwup, and Russia's cyber rampage...

CVE-2022-22328

IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871...

CVE-2022-22328

IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871...

PT-2022-15366 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager version 6.2.0 Description: The issue allows a malicious user to elevate their privileges and perform unintended operations on another user's data. Recommendations: For IBM Sterling Partner Engagement...

Input validation

IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens...

ROS-20220329-02

Vulnerability in the Moodle course management system, related to insufficient cleansing of user data in the Badges criteria code. Exploitation of the vulnerability could allow an attacker acting remotely, send a specially crafted query to the affected application and execute arbitrary SQL command...

KOYO Screen Creator security vulnerabilities

Koyo Electronics Industries KOYO Screen Creator is a drawing program from Koyo Electronics Industries, Japan. A security vulnerability exists in KOYO Screen Creator version 0.1.1.1, which originates from a failure to properly validate the length of user-supplied data. An attacker could exploit th...

Maccms Cross-Site Scripting Vulnerability (CNVD-2022-30791)

Maccms is a PHP-based film and television content management system CMS. v10 version of Maccms is vulnerable to a cross-site scripting vulnerability, which originates from the lack of a repeat parameter in /admin.php/admin/vod/data.html to check the data provided by the user and the output data...