3 posts tagged with this
A sensitive data exposure vulnerability in Wekan versions 8.31.0 through 8.33 allows any authenticated user to subscribe to the Meteor DDP publication "notificationUsers" and retrieve sensitive user documents including bcrypt password hashes, login session tokens, and email information due to missing authorization and field projection.
A user enumeration vulnerability in NocoDB versions up to 0.301.2 allows attackers to determine whether an email address is registered by analyzing responses from the password reset endpoint. This issue may allow attackers to collect valid user accounts for further attacks.
A vulnerability in Windows File Explorer causes NTLM authentication requests to be automatically triggered when extracting malicious .library-ms files from ZIP archives, potentially leaking NTLM hashes to an attacker-controlled SMB server.