X (Formerly Twitter): [URGENT] Opportunity to publish tweets on any twitters account

The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user. By sharing media with a victim user and then modifying the post request with the victim's account ID the media in question would be posted from the victim's account. This...

SA141 : OpenSSL Vulnerabilities 26-Jan-2017

SUMMARY Symantec Network Protection products using affected versions of OpenSSL are susceptible to several vulnerabilities. A remote attacker can exploit these vulnerabilities to cause denial of service and obtain private key information. AFFECTED PRODUCTS The following products are vulnerable:...

SA139 : November 2016 NTP Security Vulnerabilities

SUMMARY Symantec Network Protection products using affected versions of the NTP reference implementation from ntp.org are susceptible to multiple vulnerabilities. A remote attacker can modify the targets system time, prevent the target from synchronizing its time, cause denial of service through...

"Use Windows Session Credentials" options does not work for Veeam ONE Reporter and Business View websites

Challenge When using Internet Explorer , Veeam ONE Reporter and Business View websites keep asking for Windows credentials at logon despite enabling the "Use Windows session credentials" option. NOTE: Business View website is not available since version 9.5 Update 4. It was integrated with the...

SA131 : TCP Session Hijacking in Operating Systems Supporting RFC 5961

SUMMARY Blue Coat products that include a vulnerable version of an operating system that supports RFC 5961 are susceptible to a TCP session hijacking vulnerability. A remote, off-path attacker can infer the sequence numbers of an existing TCP connection, and either reset the connection or inject...

Unable to View Connection String for Veeam Reporter and Veeam Business View Websites in IIS Manager

Challenge When trying to view connection strings for Veeam Reporter and Veeam Business View websites in IIS manager, the following error messages pop up: Cause Veeam ONE encrypts these configuration settings. Solution This behavior is the product design. More Information If you have any questions...

Mac OS X Privilege Escalation

The vulnerability of the Crash Reporter component in the Mac OS X operating system is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in a privileged context using a specially created application...

Apple OS X El Capitan Crash Reporter Arbitrary Code Execution Vulnerability

Apple OS X El Capitan is an operating system on Apple devices. A security vulnerability in Apple OS X El CapitanCrash Reporter allows attackers to exploit the vulnerability to execute arbitrary code with root privileges...

CVE-2016-1806

Crash Reporter in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app...

CVE-2016-1806

Crash Reporter in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app...

Design/Logic Flaw

Crash Reporter in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app...

CVE-2016-1806

Crash Reporter in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app...

CVE-2016-1806: Improper Access Control

Crash Reporter in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app...

PT-2016-2059

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.11.5 Description The issue is related to the Crash Reporter component in Apple OS X, which has inadequate access control. This allows attackers to execute arbitrary code in a privileged context via a crafted app...

Arbitrary Command Execution Vulnerability in Reporter System of Shanghai Bingfeng Computer Network Technology Co.

Shanghai Bingfeng Computer Network Technology Co., Ltd. is a domestic VPN, Traffic Management, Behavior Management, Link Load Balancing, Next Generation Firewall equipment supplier and IT value solution provider. Bingfeng network reporter system is a set of data report management system. Shanghai...

Arbitrary File Traversal Vulnerability in Reporter System of Shanghai Bingfeng Computer Network Technology Co.

Shanghai Bingfeng Computer Network Technology Co., Ltd. is a domestic VPN, Traffic Management, Behavior Management, Link Load Balancing, Next Generation Firewall equipment supplier and IT value solution provider. Bingfeng network reporter system is a set of data report management system. Shanghai...

SA120 : Truncated Diffie-Hellman Secret Generation in libssh2

SUMMARY Blue Coat products that include affected versions of libssh2 are susceptible to a truncated Diffie-Hellman secret length vulnerability. A remote man-in-the-middle MITM attacker can exploit this vulnerability to intercept SSH connections that originate from Blue Coat products. The MITM...

Uber: Requested and received edit access to Google form

Per the policies laid out in www.hackerone.com/uber social engineering attempts are explicitly out of scope: Social engineering attempts this includes phishing attacks against Uber employees Failure to follow these policies will result in forfeiture of any bounty and a potential ban from the...

stern - Das Reporter-Magazin - External URLs, Native code usage, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application stern - Das Reporter-Magazin published at the 'play' market has multiple vulnerabilities...

SA119 : Multiple NSS Vulnerabilities

SUMMARY Blue Coat products that include affected versions of NSS are susceptible to multiple vulnerabilities. A remote attacker can exploit these vulnerabilities to trigger arbitrary code execution. The attacker can also cause denial of service through application crashes and memory corruption...