Apple Launches Bug Bounty with Maximum $200,000 Reward

LAS VEGAS—Apple closed out Black Hat today with a long-awaited announcement that next month it will launch a bug bounty. The Apple Security Bounty will be an invitation-only program, open to two dozen researchers at the outset, said Ivan Krstic, head of security engineering and architecture. The...

Apple Transparency Report Government Requests for Data

Apple’s latest transparency report published on Wednesday shows a big increase in the number of law enforcement and government requests for account and device data. Publication of the report comes on the heels of the latest chapter in the Apple-FBI tussle over encryption and privacy. Tuesday’s...

KeyRaider Malware Steals Certificates, Keys and Account Data From Jailbroken iPhones

Researchers have discovered a new strain of iOS malware dubbed KeyRaider that targets jailbroken devices and has the ability to steal certificates, private keys, and Apple account information. The malware already has claimed the private Apple account data of more than 225,000 victims. The KeyRaid...

PT-2014-17: Weak encryption of account data in Wonderware Information Server

The specialists of the Positive Research center have detected a Weak encryption of account data vulnerability in Wonderware Information Server. Encryption of WIS is insufficient. This vulnerability could allow elevation of privileges if an attacker decrypts the credentials. The system would need ...

DEBIAN-CVE-2013-6171

checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the...

Twitter Complied with 69% of US Government Requests for Account Data

Government requests for user account information made to Twitter pale in comparison to the number made to Google, but nonetheless, the number is on the rise according to Twitter’s Transparency Report, released today. Twitter’s report said government requests are generally made in conjunction with...

CVE-2010-2913

The Citibank Citi Mobile app before 2.0.3 for iOS stores account data in a file, which allows local users to obtain sensitive information via vectors involving 1 the mobile device or 2 a synchronized computer...

Design/Logic Flaw

The Citibank Citi Mobile app before 2.0.3 for iOS stores account data in a file, which allows local users to obtain sensitive information via vectors involving 1 the mobile device or 2 a synchronized computer...

CVE-2010-2913

The Citibank Citi Mobile app before 2.0.3 for iOS stores account data in a file, which allows local users to obtain sensitive information via vectors involving 1 the mobile device or 2 a synchronized computer...

CVE-2010-2913

The CVE-2010-2913 entry concerns the Citi Mobile iOS app prior to version 2.0.3, where account data is stored in a local file. This creates a risk that local users can access sensitive information via (1) the mobile device itself or (2) a computer synchronized with the device. The available docum...

Code injection

Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...

CVE-2007-6319

Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...

CVE-2007-6319

Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...

CVE-2002-0259

CVE-2002-0259 affects InstantServers MiniPortal 1.1.5 and earlier. The vulnerability arises from storing sensitive login/account data in plaintext in (1) .pwd files under miniportal/apache, and (2) mplog.txt, enabling local users to gain privileges. Details in connected records confirm the file p...