Make way for the GDPR: Is your business ready?

In Week 2 of National Cyber Security Awareness Month NCSAM, the spotlight is on businesses—particularly, their more profound need to take cybersecurity seriously in this age of breaches. And what better way for them to start this off than to think about how they can improve on handling and storin...

OnePlus Secretly Collects Way More Data Than It Should — Here’s How to Disable It

There is terrible news for all OnePlus lovers. Your OnePlus handset, running OxygenOS—the company's custom version of the Android operating system, is collecting way more data on its users than it requires. A recent blog post published today by security researcher Christopher Moore on his website...

Weblate: The username of an account can be ..

Hello, Description: The username of an account can be set to ... This makes it impossible to view the public profile of this account. POC: I have claimed the username .. on the demo.weblate.org site. It is impossible to view this account's public profile page. Here is the public profile page:...

HackerOne: Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers

Summary: Transitioning a private program to public does not clear the previously private updates to hackers Description Include Impact: If you are managing a private bug bounty program and choose to message hackers in the program with a targeted bounty campaign or other limited / private messagin...

About the security content of Safari 9.0.3 - Apple Support

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website. For information about...

Bumble: Password modification without knowing actual password & httpOnly bypass

Two issues: Session cookie is returned in HTML source code of /encounters page, which would allow an XSS attacker to steal it, even if httpOnly is activated. A secret value, present in HTML source code of some api.phtml pages, can be used to modify user's password without knowing actual one...

Microsoft Edge's InPrivate Mode Finally Keeps Your Activity Private

Browsing the Web in 'Private Mode' is not as private as you think. Microsoft has patched the Private Browsing Leakage bug in its newest Edge browser with the latest update. When we talk about Browsers, only one thing which does not strike our mind is Internet Explorer or IE. Even there were some...

About the security content of Safari 9.0.3

About the security content of Safari 9.0.3 This document describes the security content of Safari 9.0.3. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. T...

About the security content of iOS 9.2.1

About the security content of iOS 9.2.1 This document describes the security content of iOS 9.2.1. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To lear...

Microsoft Responds To Windows 10 Spying Concerns, But It will Still Collect Your Data

After a number of controversial data mining features and privacy invasions within Microsoft's newest operating system, Microsoft finally broke the ice, almost two months since the launch of Windows 10. Microsoft has finally responded to the growing privacy concerns around its new operating system...

openSUSE Security Update : tor (openSUSE-2015-569)

Tor was updated to fix one logging privacy issue. The following issue was fixed : - Malformed hostnames in socks5 requests were written to the log regardless of SafeLogging option CWE-532 boo943362 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

Facebook Fired An Intern After He Exposes How to Track Users' Location

Previously, we posted about a privacy issue in Facebook messenger; Aran Khanna, a Harvard University student, discovered ‘A Marauder’s Map’ that could sense and give the geolocations of your friends on the messenger. Khanna had received an opportunity to work as an intern for Facebook… …But desti...

Wifi direct system messages don't require a permission — Mozilla

Paul Theriault of Mozilla discovered a privacy issue with a WiFi-related system message that wasn't properly restricted to apps with the "wifi-manage" permission. As a result, even unprivileged apps could have received those messages, allowing them to extract limited information from a vulnerable...

X (Formerly Twitter): Privacy Issue on protected tweets

Hello Twitter Security Team, Problem: Here is a privacy issue that break your privacy for protected tweets. Details: I have two accounts on twitter @dia2diab and @Dia2diabTest , from the first one i changed the settings of Tweet privacy to be "Protect my Tweets" and now if you access one of my...

APPLE-SA-2014-11-17-2 OS X Yosemite 10.10.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-11-17-2 OS X Yosemite 10.10.1 OS X 10.10.1 is now available and addresses the following: CFNetwork Available for: OS X Yosemite v10.10 Impact: Website cache may not be fully cleared after leaving private browsing Description: A privacy...

Ubuntu: Security Advisory (USN-2373-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Inconsistent video sharing within iframe — Mozilla

Mozilla developers Eric Shepherd and Jan-Ivar Bruaroey reported issues with privacy and video sharing using WebRTC. Once video sharing has started within a WebRTC session running within an , video will continue to be shared even if the user selects the Stop Sharing" button in the controls. The...

Google Play App Permissions Privacy, Security Concerns

Google’s revamped app permissions for Google Play are not being well received by Android users. Reddit threads are rife with adjectives such as “stupid” and “dangerous,” primarily because Google’s attempt to simplify permissions granted to automatically updated applications may in fact expose use...

Phishing Campaign Sending Dropbox Links to Zeus Downloads

With more enterprises sharing documents through Dropbox, the free online storage service is popping up in more spam and phishing scams. The latest doesn’t necessarily target data stored by individuals and companies on Dropbox, but instead preys on the trust users have in the service. Researchers ...

[CVE-2013-6835] - iOS 7.0.6 Safari/Facetime-Audio Privacy issue

Affected Vendor: https://www.apple.com/ - Affected Software: Safari/Facetime on iOS - Affected Version: iOS 7 prior to 7.1 - Issue Type: Lack of user confirmation leading to a call being established, revealing the user's identity phone number or email address - Release Date: March 10, 2014 -...