Two Former Twitter Employees Caught Spying On Users For Saudi Arabia

Two former employees of Twitter have been charged with spying on thousands of Twitter user accounts on behalf of the Saudi Arabian government, likely with the purpose of unmasking the identity of dissidents. According to an indictment filed on November 5 and unsealed just yesterday, one of the...

Security Bulletin: IBM Maximo Anywhere does not have device root detection. (CVE-2019-4265)

Summary IBM Maximo Anywhere does not have device root detection which could result in an attacker gaining sensitive information about the device. Vulnerability Details CVEID: CVE-2019-4265 DESCRIPTION: IBM Maximo Anywhere does not have device root detection would could result in an attacker gaini...

Craft CMS 2.7.93.2.5 - Information Disclosure

Craft CMS 2.7.93.2.5 - Information Disclosure Exploit Title : CraftCms Users information disclosure From uploaded File Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On :...

Fuji Electric FRENIC Loader Out-of-Bounds Read Vulnerability

The Fuji Electric FRENIC Loader is an AC inverter from Fuji Electric Japan. An out-of-bounds read vulnerability exists in Fuji Electric FRENIC Loader 3.5.0.0 and prior versions, which can be exploited by an attacker to read limited information from the device...

Design/Logic Flaw

Aterm WF1200CR and Aterm WG1200CR Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors...

CVE-2018-13319

CVE-2018-13319 concerns Buffalo TS5600D1206 firmware, affected in version 3.61-0.10, where an incorrect access control in get_portal_info permits an unauthenticated POST request to disclose sensitive device information. This vulnerability represents an information disclosure risk due to insuffici...

CVE-2018-19111

The Google Cardboard application 1.8 for Android and 1.2 for iOS sends potentially private cleartext information to the Unity 3D Stats web site, as demonstrated by device make, model, and OS...

CVE-2018-7924

Anne-AL00 Huawei phones with versions earlier than 8.0.0.151C00 have an information leak vulnerability. Due to improper permission settings for specific commands, attackers who can connect to a mobile phone via the USB interface may exploit this vulnerability to obtain specific device information...

Seeker v1.0.7 - Get Accurate Location using a Fake Website

Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your loction just like many popular location based websites. Seeker Hosts a fake website on Apache Server and uses Ngrok , website asks for Location Permission and if the us...

CVE-2018-7921

Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjacent attackers may exploit this vulnerability to obtain device information...

CVE-2018-7921

Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjacent attackers may exploit this vulnerability to obtain device information...

CVE-2018-7921

Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjacent attackers may exploit this vulnerability to obtain device information...

Red Hat glusterfs server arbitrary file read vulnerability

Red Hat glusterfs server is an open source distributed file system from Red Hat Red Hat. The system is mainly for media streaming , data analysis and other data and bandwidth intensive tasks to create large-scale distributed storage solutions. A security vulnerability exists in the Red Hat...

Huawei B315s-22 Information Disclosure Vulnerability

The Huawei B315s-22 is a home 4G router. The Huawei B315s-22 suffers from an information disclosure vulnerability that can be exploited by an unauthenticated LAN attacker to obtain partial device information...

Jumpstart your Microsoft Graph Security API integration with the new JavaScript sample app

The Microsoft Graph Security API, which launched this spring, is a unified REST API for integrating data and intelligence from Microsoft products, services, and partners. Using Microsoft Graph, developers can easily build applications that consolidate and correlate security alerts from multiple...

ReverseAPK - Quickly Analyze And Reverse Engineer Android Packages

Quickly analyze and reverse engineer Android applications. FEATURES: Displays all extracted files for easy reference Automatically decompile APK files to Java and Smali format Analyze AndroidManifest.xml for common vulnerabilities and behavior Static source code analysis for common vulnerabilitie...

BeaconMedaes TotalAlert Scroll Medical Air Systems

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: BeaconMedaes Equipment: TotalAlert Scroll Medical Air Systems web application Vulnerabilities: Improper Access Control, Insufficiently Protected Credentials, Unprotected Storage of Credentials 2...

Privilege escalation

Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device...

CVE-2017-9317

Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device...

CVE-2018-7244

An information disclosure vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server Port 80/443/TCP of the affected devices could allow a remote attacker to obtain sensitive device information if network...