CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

Design/Logic Flaw

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data e.g., name, address, and previous orders of any other customer...

epj.ee Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1073374 Security Researcher error404 Helped patch 534 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting epj.ee website and its...

Nord Security: User data not anonymized is sent to analytics server

A good report from @martinbydefault. Although we have never received the IDs and they could not be linked with any specific events, we have removed the connection events altogether. While, even prior to the fix, it was impossible to tie the ID with the username or activity, the reporter's concern...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud and Adobe Acrobat Reader Document Cloud, as well as Adobe Acrobat 2017 and Adobe Acrobat Reader 2017, stem from incorrect path name restrictions for restricted access catalogs. This allows attackers to disclose protected information within the context of the current user.

The vulnerability of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader 2017 exists due to a flawed limitation regarding the path name to the restricted catalog. Exploiting this vulnerability can...

California's Tough New Privacy Law and Its Biggest Challenges

The California Consumer Privacy Act is being touted as one of the strongest privacy regulations in the U.S. enacted so far. However, though the CCPA was adopted on January 1, 2020, the act still has several loose ends and privacy loopholes that need to be fleshed out. At a high level ,the CCPA...

Outlook profile fails to load with Error: "Your Outlook data file cannot be configured."

Outlook profile fails to load with error "Your Outlook data file cannot be configured. C:\Users\AppData\Local\Microsoft\Outlook\ - OFFICE365.OST...

CVE-2019-19985

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure...

WordPress Email Subscribers & Newsletters Unauthenticated File Download Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated file download vulnerabili...

The vulnerability of the S Pip content management system, related to the disclosure of user information, allows a violator to gain unauthorized access to this information.

The vulnerability of the Scribunto content management system is related to the disclosure of user information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to information...

Cross site scripting

A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link, the attacker can view all data the attacked user can view, as well as perform all actions in the name of the user. If the user is an...

PT-2019-15358 · Siemens · Sinvr/Sivms Video Server

Name of the Vulnerable Software and Affected Versions: SiNVR/SiVMS Video Server versions prior to V5.0.0 Description: A vulnerability has been identified in the HTTP service of the SiVMS/SiNVR Video Server, which contains an authentication bypass issue. This allows a remote attacker with network...

studio.focus.tv Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1031851 Security Researcher devl00p Helped patch 2974 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting studio.focus.tv website...

Nextcloud: Anonymous file drop page ignores user profile visibility restrictions

User profile on Nextcloud server by url like https:///index.php/settings/user includes personal information: photo, name, email address. For each listed fields user can select the visibility settings: local, contacts, public. It is expected that these settings will work in all places of the...

lifeextensioneurope.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1027046 Security Researcher g0bl1nsec Helped patch 3754 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting lifeextensioneurope.com...

CVE-2019-5263

HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305MAC and earlier versions and HwBackup with earlier versions before 9.1.1.308 have a brute forcing encrypted backup data vulnerability. Huawei smartphone user backup information can be obtained by brute forcing the password for encrypting th...

OnePlus website hacked to breach user data AGAIN!

By Waqas The official website of popular Chinese telecom giant OnePlus has been hacked again... This is a post from HackRead.com Read the original post: OnePlus website hacked to breach user data AGAIN!...

CVE-2019-3428

The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal in HTTP, resulting in users’ information leakage...