TikTok Assures U.S. Lawmakers it's Working to Safeguard User Data From Chinese Staff

Following heightened worries that U.S. users' data had been accessed by TikTok engineers in China between September 2021 and January 2022, the company sought to assuage U.S. lawmakers that it's taking steps to "strengthen data security." The admission that some China-based employees can access...

GHSA-5M48-C37X-F792 Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to...

CVE-2021-37791

MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin...

CVE-2022-1955

Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation...

Authentication flaw

Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation...

Improper access control

MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin...

CVE-2021-37791

MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin...

CVE-2022-1955

Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation...

GLPI SQL Injection Vulnerability (CNVD-2022-52290)

GLPI is an open source IT and asset management software. GLPI is vulnerable to a SQL injection vulnerability, which is caused by a login page that does not properly validate and clean up user-entered data, and can be exploited by attackers to steal sensitive user data...

PT-2022-14215

Name of the Vulnerable Software and Affected Versions Session version 1.13.0 Description The issue allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to a lack of adequate security controls to...

MyAdmin security vulnerabilities

MyAdmin is a backend management system for cdfan personal developers. A security vulnerability exists in MyAdmin v1.0, which stems from an incorrect access control vulnerability when viewing the Personal Center in /api/user/userData?userCode=admin...

Session Authorization Vulnerabilities

Session is a new type of encrypted private messenger open-sourced by Oxen. A security vulnerability exists in Session version 1.13.0. An attacker exploited the vulnerability to bypass an application's password or passcode lock to access user data...

Safety Manager Logic Controllers Rigidly Encoded Access

The vulnerability of Safety Manager and microprogrammed logic controllers from Honeywell Experion PKS lies in the use of strictly encrypted user data. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

Library Management System With QR Code 1.0 SQL Injection

Title: Library Management System with QR code Attendance 1.0 SQL Injection Author: Ashish Kumar https://www.linkedin.com/in/ashish-kumar-0b65a3184 Date: 27.06.2022 Vendor: https://www.sourcecodester.com/users/kingbhob02 Software:...

ControlEdge Microprogrammed Software Privilege Escalation

The vulnerability of microprogrammed software in programmable logic controllers like ControlEdge stems from the use of rigidly encoded user data. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

CVE-2022-32998

The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

CVE-2022-34064

The Zibal package in PyPI v1.0.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

CVE-2022-34056

The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

CVE-2022-34055

The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

CVE-2022-33003

The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...