Apps on smartphones are selling and sharing our location data 24/7

By Waqas It's no surprise that the apps we download on our smartphones are tracking our movements and also transferring the information to third parties without our consent. Last year it was Google caught collecting location data of Android users even if their device's location service was off th...

UBUNTU-CVE-2018-18494

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...

DuckDuckGo study claims Google Incognito searches are not private

By Waqas Google offers customized search results even in Incognito Mode, study. DuckDuckGo claims that Google’s search results aren’t just based on your location data and previous searches normally but also when you are logged out or browsing in incognito mode. It’s a fact that offering...

Omron CX-Programmer Detection (Windows SMB Login)

SMB login-based detection of Omron CX-Programmer. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Hey Belfast, Imperva’s Moving Into The Neighborhood

As a local, I’m very excited to be Imperva’s first Belfast hire, in charge of spinning up the operation in our new European location. Imperva provides best-in-class data and application security solutions on premises, in the cloud, and in hybrid environments. As we position ourselves for the next...

rubygems: Path traversal when writing to a symlinked basedir outside of the root

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in installlocation function of package.rb that can result in...

rubygems: Path traversal when writing to a symlinked basedir outside of the root

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in installlocation function of package.rb that can result in...

rubygems: Path traversal when writing to a symlinked basedir outside of the root

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in installlocation function of package.rb that can result in...

Consumer Advice: Kids GPS tracker watch security

Parents are advised to rethink using GPS tracking watches for their children as a result of serious security concerns. Tracker watches can be worn by children and report their position to their parents via a mobile app. They are designed to increase child safety: you always know where your child...

Design/Logic Flaw

In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112159033...

CVE-2018-9526

In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112159033...

Unpatched Android OS Flaw Allows Adversaries to Track User Location

A flaw in the Android mobile operating system could allow an attacker with physical proximity to a WiFi router to track the location of users within the router’s range. The issue CVE-2018-9581 allows information leakage stemming from inter-process communication. While applications on Android are...

Top 5 Factors That Increase Cyber Security Salary The Most

Our partner Springboard, which provides online courses to help you advance your cybersecurity career with personalized mentorship from industry experts, recently researched current cybersecurity salaries and future earning potential in order to trace a path to how much money you can make. Here's...

Splunk Discovery Day Moscow 2018

Today I attended the Splunk Discovery Day 2018 conference. It is something like a local equivalent of the famous Splunk .conf. More than 200 people have registered. The event was held in the luxury Baltschug Kempinski hotel in the very center of Moscow with a beautiful view of the Red Square and...

CVE-2018-18551

ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type parameter, sensors.html device parameter, report.html location parameter, groupdelete.html group parameter, reportsave.html query parameter, sensors.html...

CVE-2018-18551

ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type parameter, sensors.html device parameter, report.html location parameter, groupdelete.html group parameter, reportsave.html query parameter, sensors.html...

HackerOne: Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based"

Hi, I would like to report something I just recently noticed upon receiving an automated invite from Hackerone for a private program. The program brief clearly states the following in program rules: █████ This is where I believe the issue is. I live in ███ and according to the program rules I...

Design/Logic Flaw

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mtrand unsafely, resulting in predictable database backup file locations...

Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '' forward slashes sequences that can resolve to a location that is outside of that directory when...

30M Facebook breach; includes users phone numbers and location data

By Waqas FBI has asked Facebook not to discuss who may be behind this attack. On September 28th, 2018 the social media giant Facebook announced that it suffered a massive data breach in which hackers stole access tokens of millions of accounts after exploiting a critical vulnerability in its "Vie...