#chrome

Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as private/public.

An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.

Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.

A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipulation of the argument tb_search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213039.

A cross-site scripting (XSS) vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php.

Investment round led by 11.2 Capital, Okta Ventures, and Mango Capital.

By Habiba Rashid The apps reported by Malwarebytes contain Android trojan yet the developer is still active on Google Play, continuing their scam. This is a post from HackRead.com Read the original post: Google Fails To Remove “App Developer” Behind Malware Scam

The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password.

By Waqas Z-Library offered pirated e-books for free and proved a suitable alternative to expensive originals. This is a post from HackRead.com Read the original post: Tor domain remains online after Feds seize Z-Library websites