8093 matches found
How to steal a million (of your data)
Any user data — from passwords for entertainment services to electronic copies of documents — is highly prized by intruders. The reason is simply that almost any information can be monetized. For instance, stolen data can be used to transfer funds to cybercriminal accounts, order goods or service...
Microsoft SharePoint XSS
The vulnerability of the Microsoft SharePoint software package is related to insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute cross-site scripting attacks with elevated privileges using a specially created...
Microsoft Exchange Server XSS
The vulnerability of Microsoft Exchange Server lies in insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor to remotely execute cross-site scripting attacks and execute arbitrary code in the context of the current user, by sending a specially...
Adult Sites Lack Privacy, Open the Door for Harassment and Tracking
An analysis of 22,500 porn sites found that third-party tracking of users is rampant, privacy policies are difficult to understand and a majority fail to implement basic HTTPS encryption. In all, it’s a recipe for enabling sexual violence and shaming, according to an academic paper released this...
Information leakage vulnerability in the system of Sida Fluoroplastics Co.
Inadequate security filtering processing measures in this product allow users to obtain user information without authentication. By exploiting this vulnerability, an attacker can obtain user information without authorization http://60.191.211.210:8088/yyoa/assess/js/initDataAssess.jsp...
Facebook to Pay $5 Billion Fine to Settle FTC Privacy Investigation
After months of negotiations, the United States Federal Trade Commission FTC has approved a record $5 billion settlement with Facebook over its privacy investigation into the Cambridge Analytica scandal. The settlement will put an end to a wide-ranging probe that began more than a year ago and...
MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting
Exploit Title: MyT Project Management - Userusername Stored Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://manageyourteam.net/index.html Software Link: https://sourceforge.net/projects/myt/files/latest/download Version: 1.5.1 Category: Webapps Tested o...
Security Bulletin: IBM QRadar SIEM is vulnerable to an Information exposure (CVE-2019-4054)
Summary IBM QRadar SIEM could disclose potentially sensitive information about users during content export. Vulnerability Details CVEID: CVE-2019-4054 Description: IBM QRadar could allow a local user to obtain sensitive information when exporting content that could aid an attacker in further...
Zhucheng City Three Swords Network Media Co., Ltd. online shopping mall web system has xss vulnerability
Zhucheng City Three Swords Network Media Co., Ltd. is an Internet web application development company, which has built online shopping mall web systems for many customers. Zhucheng City Three Swords Network Media Co., Ltd. online shopping web system has xss vulnerability, the attacker can embed...
CVE-2019-13239
inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...
Related vulnerabilities have now been patched: the Orvibo smart home devices disclosure of user information-bug warning-the black bar safety net
From Orvibo aspect to understand, this relates to the information disclosure of the security vulnerability has now been fixed, and the user information of the protection level, at the same time they also want and professional information security research team into cooperation with the protection...
PT-2019-9075
Name of the Vulnerable Software and Affected Versions LOYTEC LGATE-902 version 6.3.2 Description The issue allows for Cross-Site Scripting XSS attacks. XSS is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take contr...
agrupamento-fajoes.pt Cross Site Scripting vulnerability
Security Researcher ZeroNameless Helped patch 29 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting agrupamento-fajoes.pt website and its users. Following coordinated and responsible...
CVE-2019-4382
IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...
PT-2019-17050 · Ibm · Ibm Api Connect
Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows an unauthorized user to obtain sensitive information about system users by using specially crafted HTTP requests. Recommendations: For versions 5.0.0.0 through...
Sign in with Apple
What's in a Login Button? All you need to know about the new "Sign in with Apple" For Akamai Identity Cloud, we intend to support our clients that wish to implement "Sign in with Apple" just like we do for Facebook, Google, Instagram, Twitter, LinkedIn and about 30 other Identity Providers. If yo...
dinosaurprotectiongroup.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-863836 Security Researcher CoderYounes Helped patch 1033 vulnerabilities Received 5 Coordinated Disclosure badges Received 8 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting...
Insecure Deletion
github.com/pydio/cells is vulnerable to insecure deletion. User data is not securely deleted. A new user created with the same user ID as the deleted user will be able to restore the deleted user's data...
Pydio Cells Information Disclosure Vulnerability (CNVD-2019-21234)
Pydio Cells is a transition application for managing files on a Pydio Cells 1.2.X server. An information disclosure vulnerability exists in versions of Pydio Cells prior to 1.5.0 that stems from Pydio Cells failing to completely delete a user's data when deleting that user, which can be exploited...
