CVE-2019-11753

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the...

Implant Teardown

Posted by Ian Beer, Project Zero In the earlier posts we examined how the attackers gained unsandboxed code execution as root on iPhones. At the end of each chain we saw the attackers calling posixspawn, passing the path to their implant binary which they dropped in /tmp. This starts the implant...

AIL Framework - Framework for Analysis of Information Leaks

AIL is a modular framework to analyse potential information leaks from unstructured data sources like pastes from Pastebin or similar services or unstructured data streams. AIL framework is flexible and can be extended to support other functionalities to mine or process sensitive information e.g...

Fedora 29 : 1:libreoffice (2019-2fe22a3a2c)

CVE-2019-9850 Insufficient url validation allowing LibreLogo script execution - CVE-2019-9851 LibreLogo global-event script execution - CVE-2019-9852 Insufficient URL encoding flaw in allowed script location check ---- - CVE-2019-9848 LibreLogo arbitrary script execution - CVE-2019-9849 remote...

CVE-2019-6177

A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to...

CVE-2019-11551

In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code42 app to a location they do not have privileges to write...

WordPress wp-google-map-plugin plugin cross-site request forgery vulnerability (CNVD-2019-28881)

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-map-plugin plugin is a Google Maps plugin used in it. A cross-site request forgery vulnerability exists in th...

PT-2019-13728 · Evolution Cms · Evolution Cms

Name of the Vulnerable Software and Affected Versions: Evolution CMS versions 2.0.x Description: The issue allows for XSS via a description and new category location in a template. The vendor states that the behavior is consistent with the access policy in the administration panel. Recommendation...

CVE-2017-18510

The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions...

CVE-2015-9307

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature...

Vanilla: Stealing the ip addres from users

Hi team! Summary Pixel that steals your data. By creating an image in https://iplogger.org/ and inserting it in the forum we can steal some data ip, language, geo location of the users who see the message. Steps to reproduce + Set "wyswyg" on + Create an image from https://iplogger.org/ and use t...

openSUSE Security Update : chromium (openSUSE-2019-1848)

This update for chromium to version 76.0.3809.87 fixes the following issues : - CVE-2019-5850: Use-after-free in offline page fetcher boo1143492 - CVE-2019-5860: Use-after-free in PDFium boo1143492 - CVE-2019-5853: Memory corruption in regexp length check boo1143492 - CVE-2019-5851:...

4 Dating Apps Pinpoint Users' Precise Locations – and Leak the Data

Four popular dating apps that together can claim 10 million users have been found to leak precise locations of their members. “By simply knowing a person’s username we can track them from home, to work,” explained Alex Lomas, researcher at Pen Test Partners, in a blog on Sunday. “We can find out...

OPENSUSE-SU-2019:1849-1 Security update for chromium

This update for chromium to version 76.0.3809.87 fixes the following issues: - CVE-2019-5850: Use-after-free in offline page fetcher boo1143492 - CVE-2019-5860: Use-after-free in PDFium boo1143492 - CVE-2019-5853: Memory corruption in regexp length check boo1143492 - CVE-2019-5851: Use-after-pois...

Unspecified vulnerability in cPanel (CNVD-2019-27408)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 57.9999.105. An attacker could exploit the vulnerability to...

Dating apps that track users from home to work and everywhere in-between

TL;DR We were able to precisely locate and track the users of four major dating apps, potentially putting at risk 10 million users This risk level is elevated for the LGBT+ community who may use these apps in countries with poor human rights where they may be subject to arrest and persecution. Ap...

Group sex app leaks locations, pics and personal details. Identifies users in White House and Supreme Court

We’ve seen some pretty poor security in dating apps over recent years; breaches of personal data, leaking users locations and more. But this one really takes the biscuit: probably the worst security for any dating app we’ve ever seen And it’s used for arranging threesomes. It’s 3fun. It exposes t...

Who Owns Your Wireless Service? Crooks Do.

Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptic...

Black Hat: LeapFrog Tablet Flaws Let Attackers Track, Message Kids

LAS VEGAS – Serious vulnerabilities have been disclosed in LeapFrog’s tablet for kids, the LeapPad Ultimate, once again throwing child data privacy into the spotlight. The LeapPad Ultimate is a rugged tablet made by LeapFrog that targets children with an array of education, game and eBook apps...

httpd: URL normalization inconsistency

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...