CVE-2022-1361

The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate data about other user’s accounts and devices...

CVE-2022-23802

Joomla Guru extension 5.2.5 is affected by: Insecure Permissions. The impact is: obtain sensitive information remote. The component is: Access to private information and components, possibility to view other users' information. Information disclosure Access to private information and components,...

HumHub 安全漏洞

Humhub is a set of open source social networking software written on the Yii PHP framework. HumHub has a security vulnerability that stems from the fact that users who are forced by administrators to change their passwords may be able to retrieve data from other users. No detailed vulnerability...

CVE-2022-22328

IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data. IBM X-Force ID: 218871...

Facebook Hit With $18.6 Million GDPR Fine Over 12 Data Breaches in 2018

The Irish Data Protection Commission DPC on Tuesday slapped Facebook and WhatsApp owner Meta Platforms a fine of €17 million $18.6 million for a series of security lapses that occurred in violation of the European Union's GDPR laws in the region. "The DPC found that Meta Platforms failed to have ...

Sourcecodester Hospital Patient Records Management System 安全漏洞

SourceCodester Hospital Patient Records Management System is a web-based application that provides an automated platform for hospitals to store and manage their patient records. sourceCodester Hospital Patient Records Management System version 1.0 contains a horizontal override vulnerability, whi...

Robinhood Data Breach – Hackers access millions of users’ data

By Waqas Robinhood data breach involved social engineering attack in which hackers somehow managed to gain access to the company's support system. This is a post from HackRead.com Read the original post: Robinhood Data Breach - Hackers access millions of users data...

CVE-2021-23858

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial number and the firmware version by another...

CVE-2020-29012

An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetic...

CVE-2020-26801

A stored cross-site scripting XSS vulnerability was discovered in /Forms/devicevars1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request...

LabCup 授权问题漏洞

LabCup is a laboratory and research organization software management system from LabCup Ireland. It helps academic researchers and safety officers with chemical inventory management, risk assessment and compliance. An authorization issue vulnerability exists in LabCup, which arises from the abili...

VulnCheck KEV: CVE-2019-9880

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username...

Fashion marketplace giant 21 Buttons exposes millions of users’ data

By Sudais Asif According to researchers, the misconfigured AWS bucket is still exposed and 21 Buttons has not responded to them. This is a post from HackRead.com Read the original post: Fashion marketplace giant 21 Buttons exposes millions of users data...

Animal Jam data breach – Hacker leaks database with millions of accounts

By Waqas The developer of famous online playground Animal Jam has suffered a data breach that exposed tens of millions of users' data. This is a post from HackRead.com Read the original post: Animal Jam data breach - Hacker leaks database with millions of accounts...

CVE-2020-15263 XSS in platform

In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4...

Mail.ru: Users information leak at sbermarket.ru

sbermarket.ru application could disclosure personal information from another request due to invalid caching settings...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Cross site scripting

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

Cloud Industry CMS has an overstepping vulnerability

Yunye CMS is an enterprise website building system developed by Luoyang Yunye Information Technology Co. Yunye CMS has an override vulnerability that can be exploited by attackers to obtain information about other users...

Shenzhen ShuoWin Interactive Information Technology Co., Ltd. website building system has unauthorized access vulnerabilities

Shenzhen Shuowin Interactive Information Technology Co., Ltd. is an Internet technology development, product design, economic and trade consulting and other projects. Shenzhen Shuowin Interactive Information Technology Co., Ltd. website building system has an overstepping vulnerability, attackers...