July 18, 2017—KB4025334 (OS Build 14393.1532)

None None...

games.espn.com XSS vulnerability

Vulnerable URL: http://games.espn.com/ffl/signin?redir='--"alert"OPENBUGBOUNTY"...

June 27, 2017—KB4022716 (OS Build 15063.447)

None None...

CVE-2017-0498

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

CVE-2017-0498

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

Denial of service

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

CVE-2017-0498

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

CVE-2017-0498

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

tailor4less.com XSS vulnerability

Vulnerable URL: https://www.tailor4less.com/de/customer/signin Details: Description| Value ---|--- Patched:| Yes, at 22.02.2017 Latest check for patch:| 22.02.2017 07:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 60710 VIP website status:| No Check...

Don't Fall For This Dangerously Convincing Ongoing Phishing Attack

Security researchers have discovered a new phishing campaign targeting Gmail users, which is so convincing and highly effective that even tech-savvy people can be tricked into giving away their Google credentials to hackers. The attackers first compromise a victim's Gmail account, and once they a...

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 This update rollup is superseded by July 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 KB3172614 that was released on July 21, 2016. The June 2016 update rollup for Windows RT 8.1,...

Over 1 Billion Mobile App Accounts can be Hijacked Remotely with this Simple Hack

Security researchers have discovered a way to target a huge number of Android and iOS apps that could allow them to remotely sign into any victim's mobile app account without any knowledge of the victim. A group of three researchers – Ronghai Yang, Wing Cheong Lau, and Tianyu Liu – from the Chine...

bandmix.co.uk XSS vulnerability

Vulnerable URL: http://www.bandmix.co.uk/sign-in/ Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 11:53 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 301726 VIP website status:| No Check bandmix.co.uk SSL...

October 11, 2016 — KB3194798 (OS Build 14393.321)

None None...

October 11, 2016 — KB3192441 (OS Build 10586.633)

None None...

October 11, 2016 — KB3192440 (OS Build 10240.17146)

None None...

September 13, 2016 — KB3185611 (OS Build 10240.17113)

None None...

Instacart: Brute force login and bypass locked account restrictions via iOS app

When logging in to an account on the website, a user's account gets locked out after 15 tries to prevent an attacker from brute forcing access to the account. These same restrictions do not apply to the mobile sign-in endpoint a POST request to https://www.instacart.com/oauth/token, which allows ...

my.luckymarble.com XSS vulnerability

Open Bug Bounty ID: OBB-174317 Description| Value ---|--- Affected Website:| my.luckymarble.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Harvest: CSRF token fixation in Sign in with Google

Hi There is CSRF token fixation in Sign in with Google at https://id.getharvest.com/sessions/new The state parameter is same for any time login https://id.getharvest.com/oauth2/callback?state=%7B%22intent%22:%22sign-in%22%7D&code=code Steps to reproduce 1. Go to...