14024 matches found
handbagexpress.com Cross Site Scripting vulnerability OBB-1392779
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
QNAP Releases Security Updates for QNAP Helpdesk
QNAP Systems has released security updates to address vulnerabilities in QNAP Helpdesk. An attacker could exploit these vulnerabilities to take control of an affected QNAP network-attached storage NAS device. The Cybersecurity and Infrastructure Security Agency CISA encourages users and...
How Google's Android Keyboard Keeps ‘Smart Replies’ Private
The latest Gboard feature needs to know as much as possible about your digital life to work—but doesn't share that data with Google...
Comcast TV Remote Hack Opens Homes to Snooping
A security flaw allowing attackers to remotely snoop in on victims’ private conversations was found to stem from an unexpected device – their TV remotes. The flaw stems from Comcast’s XR11, a popular voice-activated remote control for cable TV, which has more than 18 million units deployed across...
New Privacy Features in iOS 14
A good rundown...
CISA Releases FY2019 Risk Vulnerability Assessment Infographic
The Cybersecurity and Information Security Agency CISA has released an infographic mapping analysis of 44 of its Risk and Vulnerability Assessments RVAs conducted in Fiscal Year 2019 to the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT&CK Framework. The infographic identifies...
Grindr's Bug Bounty Pledge Doesn't Translate to Security
SAS@Home 2020– After a Grindr security flaw was disclosed this week, the dating site promised it would launch a bug-bounty program in an effort to “keep its service secure.” But Katie Moussouris, CEO of Luta Security and a bug bounty program expert, warned at this week’s SAS@home virtual event th...
Male Chastity Device Comes with Massive Security Flaws
Researchers at Pen Test Partners recently uncovered concerning security issues with a connected male chastity device and are calling on the entire connected sex toy industry — known as “teledildonics” — to make security a priority. The Qiui Cellmate chastity cage has a Bluetooth lock that could...
Smart male chastity lock cock-up
TL;DR Smart Bluetooth male chastity lock, designed for user to give remote control to a trusted 3rd party using mobile app/API Multiple API flaws meant anyone could remotely lock all devices and prevent users from releasing themselves Removal then requires an angle grinder or similar, used in clo...
mybroadband.co.za Improper Access Control vulnerability OBB-1380074
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CISA and CNMF Identify a New Malware Variant
The Cybersecurity and Infrastructure Security Agency CISA and the Department of Defense DOD Cyber National Mission Force CNMF have identified a malware variant—referred to as SLOTHFULMEDIA—used by a sophisticated cyber actor. In addition, U.S. Cyber Command has released the malware sample to the...
ASB-A-157708122
In AudioFlinger::RecordThread::threadLoop of audioflinger/Threads.cpp, there is a possible non-silenced audio buffer due to a permissions bypass. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...
Design/Logic Flaw
An issue was discovered in filedownload.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the supposedly private attachments linked to these notes by accessing the corresponding file download URL directly...
Buying a Domain: What About Privacy Protection?
By Owais Sultan You can get a domain without compromising on privacy protection. Here's how and why you need to protect your privacy as a domain owner. This is a post from HackRead.com Read the original post: Buying a Domain: What About Privacy Protection?...
Identity Fraud: How to Protect Your Identity Data, Accounts and Money During the Coronavirus Crisis
We’ve all been spending more of our time online since the crisis hit. Whether it’s ordering food for delivery, livestreaming concerts, holding virtual parties, or engaging in a little retail therapy, the digital interactions of many Americans are on the rise. This means we’re also sharing more of...
Corona Exposure Notifications API Data Leakage
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Corona Exposure Notifications API for Apple iOS and Google Android risk of coercion/data leakage post notification CVE-2020-24721 / CVSS v3.1 score: 5.9 AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:H/RL:U/RC:C/CR:H/IR:L...
CISA Releases Telework Essentials Toolkit
The Cybersecurity and Infrastructure Security Agency CISA has released the Telework Essentials Toolkit, a comprehensive resource of telework best practices. The Toolkit provides three personalized modules for executive leaders, IT professionals, and teleworkers. Each module outlines distinctive...
The Network Perimeter: This Time, It’s Personal
In the rear-view mirror of history, the state of cybersecurity will not take top billing away from the COVID-19 pandemic. However, the one has been significantly affected by the other, and only time will tell what the full fallout will be. The first six months of 2020 saw significant developments...
On Executive Order 12333
Mark Jaycox has written a long article on the US Executive Order 12333: "No Oversight, No Limits, No Worries: A Primer on Presidential Spying and Executive Order 12,333": Abstract: Executive Order 12,333 "EO 12333" is a 1980s Executive Order signed by President Ronald Reagan that, among other...