PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

160K COVID-19 Records: Vulnerability in Avicena Medical Laboratory

bishopfox.com | vulnerability | #vulnerability-research | #access-control | #data-exposure | #healthcare | #covid-19 | #pii | #kosovo
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox found that Kosovo's Avicena Medical Laboratory exposed ~166,000 COVID-19 test records through missing authorization controls—results were enumerable via an incremental sample number.
Published
Collected

Related coverage

blog · samcurry.net
Hacking Starbucks and Accessing Nearly 100 Million Customer Records
A Starbucks gift-card purchase tipped Sam Curry to suspicious /bff/proxy/ API calls; probing the backend-for-frontend routing ultimately exposed nearly 100 million customer records.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
vulnerability · hackerone.com
How an Information Disclosure Vulnerability Led to Critical Data Exposure
Information disclosure makes up 10% of HackerOne findings. The article covers how exposed keys, source code, and PII enable further attacks, plus prevention via error handling and encryption.
vulnerability · hackerone.com
Logging: The Silent Security Guard and Its Pitfalls
Logs are the breadcrumbs of security investigations, yet careless practices can leak passwords and PII or expose the logging pipeline to abuse. This post weighs the benefits against the risks.
vulnerability · yeswehack.com
YesWeHackEDU: Addressing talent shortage through Bug Bounty
YesWeHackEDU mobilizes real-world bug hunting scenarios for cybersecurity training; the March 2020 post announces two months of free licenses from 1 April to support universities during COVID-19.
Medium · vulnerability · github.com
CVE-2026-84636: Apple iOS/macOS SCDynamicStore Wi-Fi SSID Info Disclosure PoC
Wi-Fi SSID data is strictly guarded as sensitive location telemetry on iOS. This PoC shows that third-party applications could bypass sandbox entitlement checks via SCDynamicStore to silently track user network environments and physical locations.
Back