Smart Ski Helmet Headphone Flaws Leak Personal, GPS Data

Researchers have found a slew of vulnerabilities in a pair of smart headphones designed to fit under ski helmets. The flaws could allow a bad actor to view victims’ personal information, track them and even listen to their private conversations via the headphones’ walkie-talkie function, which us...

Lenovo Watch X Riddled with Security Vulnerabilities

Researchers are raking the Lenovo Watch X over the security coals in a report that blasts the device for shipping with a half dozen “disturbing” privacy and security vulnerabilities. The budget $50 smartwatch was introduced in June 2018 and was initially praised for its design, features and...

Thousands of Internet connected hot tubs vulnerable to remote attacks

By Waqas Weak security practices have rendered IoT devices vulnerable to hacking and all sorts of cyber-attacks. According to the research from a Buckinghamshire-based security group Pen Test Partners, hot tubs can also be hacked using an app simply because there isn’t any authentication process ...

Schneider Electric EcoStruxure

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: EcoStruxure Vulnerability: Open Redirect 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to use this device as a platform to...

Hackers Succeed in NASA Mission, Lifting Thousands of Employee Records

NASA has become the latest victim of a breach, but it’s unlikely that sensitive space mission data was impacted. In an internal memo sent to employees, NASA admitted that it was hacked by an unauthorized intruder in October, and that personally identifiable information for thousands of employees...

Mobile Shopping Growth Accelerates During Diwali

Diwali is the Hindu festival of lights, celebrated every autumn in October or November. According to Redseer Consulting, the sales volume during the festival usually accounts for about 35%-40% of the annual sales of e-commerce in India; for 2018 Redseer predicts $2.5 to $3 billion gross merchandi...

Shopify: POST-based XSS on apps.shopify.com

Hello Shopify team! I found a post-based XSS which may be shared to other users and occurs in firefox, IE, Edge. How to reproduce: 1. at partners.shopify.com go to apps - choose one - more actions - create shopify app store listing 2. you will get redirected to url with ?signature parameter. Full...

Standing behind “MSRC Listens”

Last week at BlueHat’s “MSRC Listens” session, I took the stage with Mechele Gruhn, manager of the Vulnerability Response PM team, to explain how MSRC is changing our communication, workflows, and tooling to deliver an improved user experience for our partners in the security research community. ...

Partner Perspectives: Defense in Depth with Carbon Black and ProtectWise

Ramon Peypoch is the Chief Product Officer for ProtectWise. Navigating the number of enterprise security point products used to defend against today’s threat landscape can be overwhelming. Some sources say the average enterprise uses 75 security products to secure its network. Reducing the number...

blumentals.net XSS vulnerability

Open Bug Bounty ID: OBB-664315 Description| Value ---|--- Affected Website:| blumentals.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

partners.webmasterplan.com XSS vulnerability

Open Bug Bounty ID: OBB-662693 Description| Value ---|--- Affected Website:| partners.webmasterplan.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Uber: Reflected XSS on Partners Subdomain

There was a reflected cross site scripting vulnerability at https://partners.uber.com/. By providing a specifically crafted value, it was possible for an attacker to inject malicious content into the partners.uber.com site, which would then be executed when the site is loaded. We enjoyed working...

partners.subaru.com XSS vulnerability

Open Bug Bounty ID: OBB-657022 Description| Value ---|--- Affected Website:| partners.subaru.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bucksportal.com XSS vulnerability

Open Bug Bounty ID: OBB-655797 Description| Value ---|--- Affected Website:| bucksportal.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Spectre Will Haunt Us For a Long Time

During a recent Congressional hearing, Senators voiced concerns about the ongoing Spectre and Meltdown vulnerabilities. While the technical details were predictably glossed over, most of the hearing focused on Intel informing Chinese partners about the flaws six months before they went public...

ThreatList: Supply-Chain Defenses Need Improvement

Although nearly 80 percent of respondents in a recent survey believe software supply-chain attacks have the potential to become one of the biggest cyber threats over the next three years, few organizations are prepared to mitigate the risks. This state of affairs comes as businesses lose millions...

Building a Profitable Security Services Offering Part 2 IT Security Features and Benefits Overview

Trend Micro is excited to partner with SPC International in this 5-part Blog, Webinar and Online Training Series; focused on Building a Profitable Security Services Offering for MSP Partners. Through the series, SPC will teach you a selling process of leading with security, steps in growing your...

Common Questions and Answers Salesforce ISVs Need to Know for FedRAMP

Many Salesforce Independent Software Vendors ISVs are interested in pursuing FedRAMP to serve federal customers, but have many questions about the process. The four questions below are the most common questions that Coalfire receives from these ISV partners; we have provided some basic responses ...

SUSE Linux Has Been Sold For $2.5 Billion

SUSE, the open source software company owned by British firm Micro Focus International, has been sold to a Swedish private equity firm. Yes, SUSE Linux and its associated software business has finally been acquired by EQT Partners for $2.535 billion, lifting its shares 6 percent. SUSE is one of t...

SUSE Linux Has Been Sold For $2.5 Billion

SUSE, the open source software company owned by British firm Micro Focus International, has been sold to a Swedish private equity firm. Yes, SUSE Linux and its associated software business has finally been acquired by EQT Partners for $2.535 billion, lifting its shares 6 percent. SUSE is one of t...