CVE-2018-21260

An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy...

ACLU Sues Clearview AI Over Faceprint Collection, Sale

The American Civil Liberties Union ACLU has sued a New York-based startup for amassing a database of biometric face-identification data of billions of people and selling it to third parties without their consent or knowledge The U.S. citizens’-rights watchdog organization has filed suit in the...

TikTok Violated Children’s Privacy Law, FTC Complaint Says

The popular video sharing app TikTok has landed in hot water again over privacy issues. On Thursday, a group of privacy advocates filed a complaint with the Federal Trade Commission FTC alleging the platform failed to adequately protect children’s privacy. The complaint alleged that TikTok violat...

File Explorer 1.4 Information Disclosure

Document Title: =============== File Explorer v1.4 iOS - Information Disclosure Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2220 Release Date: ============= 2020-04-28 Vulnerability Laboratory ID VL-ID:...

File Explorer v1.4 iOS - Information Disclosure Vulnerability

Document Title: =============== File Explorer v1.4 iOS - Information Disclosure Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2220 Release Date: ============= 2020-04-27 Vulnerability Laboratory ID VL-ID:...

U.S. Dept Of Defense: Sensitive Information Leaking Through Navy Website. [█████]

Summary: While performing recon work on websites owned by DoD i came up with a Navy website which is leaking sensitive information. Description: The website is leaking information such as- first name and last name, email address, phone number, location, rank, and other information of trainees in ...

U.S. Dept Of Defense: Sensitive Information Leaking Through DoD Owned Website. [██████████]

Summary While performing recon work on websites owned by DoD i came up with ██████████ website which is leaking sensitive information. Description The above website is leaking information such as- first name and last name, email address, phone number, house address and organization name of...

U.S. Dept Of Defense: Sensitive Information Leaking Through DARPA Website. [█████████]

Summary: While performing recon work on websites owned by DoD i came up with DARPA website which is leaking sensitive information. Description: The above website is leaking information such as- first name and last name, email address, phone number, house address and organization name of attendees...

Nord Security: NordVPN Android Application privacy violation due to Google Advertising Identifier misuse

The researcher reported an issue regarding somewhat incorrect GAID usage integration in our application. The concerns were valid and properly addressed by our team...

Malicious Android SDKs Caught Accessing Facebook and Twitter Users Data

Two third-party software development kits integrated by over hundreds of thousands of Android apps have been caught holding unauthorized access to users' data associated with their connected social media accounts. In a blog post published yesterday, Twitter revealed that an SDK developed by...

Bumble: The login of Hotor Not is Vulnerable to bruteforce.

I was able to validate that The Login of HotorNot is Vulnerable to BruteForcing . Steps to reproduce: 1. https://hotornot.com/signin 2.Use Burp intruder attack for BruteForcing 3.Send as many requests you want. Fix: Proper mitigation of BruteForcing should be done using Ratelimitng etc...

CVE-2019-15349

The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service named...

You Gave Your Phone Number to Twitter for Security and Twitter Used it for Ads

After exposing private tweets, plaintext passwords, and personal information for hundreds of thousands of its users, here is a new security blunder social networking company Twitter admitted today. Twitter announced that the phone numbers and email addresses of some users provided for two-factor...

Liberapay: Private target account appears in search results

Summary At policy page, there are special tailor account, highly confidential & secret ! F600997 - Hide this profile from search results on Liberapay - Prevent this profile from being listed on Liberapay - Target account hackerone-target-team Description In this exploit, I found Privacy setting...

Google Fined $170 Million For Violating Kids' Privacy On YouTube

Google has finally agreed to pay $170 million fine to settle allegations by the Federal Trade Commission and the New York attorney general that its YouTube service earned millions by illegally harvesting personal information from children without their parents' consent. The settlement requires...

Craft CMS 2.7.93.2.5 - Information Disclosure

Craft CMS 2.7.93.2.5 - Information Disclosure Exploit Title : CraftCms Users information disclosure From uploaded File Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On :...

Craft CMS 2.7.9/3.2.5 - Information Disclosure

Exploit Title : CraftCms Users information disclosure From uploaded File Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 20-07-2019 Vendor Homepage:https://craftcms.com...

Craft CMS 2.7.9 / 3.2.5 Information Disclosure

Exploit Title : CraftCms Users information disclosure From uploaded File Author Discovered By : Mohammed Abdul Raheem Author's Company Name : TrekShield IT Solution Author Exploit-db : https://www.exploit-db.com/?author=9783 Found Vulnerability On : 20-07-2019 Vendor Homepage:https://craftcms.com...

Exploiting GDPR to Get Private Information

A researcher abused the GDPR to get information on his fiancee: It is one of the first tests of its kind to exploit the EU's General Data Protection Regulation GDPR, which came into force in May 2018. The law shortened the time organisations had to respond to data requests, added new types of...

Annual Protest Raises $250K to Cure Krebs

For the second year in a row, denizens of a large German-language online forum have donated more than USD $250,000 to cancer research organizations in protest of a story KrebsOnSecurity published in 2018 that unmasked the creators of Coinhive, a now-defunct cryptocurrency mining service that was...