Millions of Apps Leak Private User Data Via Leaky Ad SDKs

SAN FRANCISCO – Millions of apps leak personal identifiable information such as name, age, income and possibly even phone numbers and email addresses. At fault are app developers who do not protect ad-targeting data transmitted to third-party advertisers. “The scale of what we first thought was...

ATI Systems Emergency Mass Notification Systems False Alert Vulnerability (CNVD-2018-07875)

ATI Systems designs, builds and installs mass notification systems for the community, campus, industrial and military markets.Emergency Mass Notification Systems is an emergency mass notification system. An unauthorized operation vulnerability exists in ATI Systems Emergency Mass Notification...

CVE-2017-16924

Remote Information Disclosure and Escalation of Privileges in ManageEngine Desktop Central MSP 10.0.137 allows attackers to download unencrypted XML files containing all data for configuration policies via a predictable /client-data//collections//usermgmt.xml URL, as demonstrated by passwords and...

CVE-2017-15546

The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database...

CVE-2017-15546

The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database...

MC RSA Authentication Manager Security Console SQL Injection Vulnerability

EMC RSA Authentication Manager is a centralized binary authentication software from EMC. The software allows centralized management of binary authentication, security tokens, methods, and users across physical sites.Security Console is one of the security console programs. A SQL injection...

NEC Univerge SV9100/SV8100 WebPro 10.0 - Configuration Download Vulnerability

NEC Univerge SV9100/SV8100 WebPro version 10.0 suffers from a remote configuration download vulnerability. The gzipped telephone system configuration file 'config.gz' or 'config.pcpx' that contains the unencrypted data file 'conf.pcpn', can be downloaded by an attacker from the root directory if...

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download Vendor: NEC Corporation Product web page: http://www.nec.com Affected version: WebPro =10.00 DSP Firmware Version: 12.11.00.02 Summary: NEC's UNIVERGEAr SV9100 is the unified communications UC solution of choice for small and...

Huawei Changsha 5S Information Disclosure Vulnerability

The Huawei Changshare 5S is a smartphone from the Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei 畅享5S. Attackers have successfully exploited the vulnerability to cause information leakage by tricking users into installing a carefully constructed applicatio...

FreeBSD -- OpenSSL multiple vulnerabilities

Problem Description: Invoking SSLread/SSLwrite while in an error state causes data to be passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSLread/SSLwrite being...

Data Pours from Cloud—And ‘The Enemy is Us’

Accenture, Verizon, Dow Jones and Deep Root Analytics are just the tip of the iceberg when it comes to the millions of private records and sensitive enterprise data exposed on cloud backends this year. And the problem is getting worse not better. “The enemy is us,” said Chris Vickery, director of...

Apple macOS High Sierra APFS is vulnerable

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.APFS is one of the file system components for Apple devices. A security vulnerability exists in the APFS component of Apple macOS High Sierra versions prior to 10.13.1. The vulnerability can be exploite...

Abbott Laboratories Multiple Pacemaker Products Erroneously Encrypt Sensitive Data Vulnerability

Accent, Anthem, Accent MRI, Assurity, Allure and Assurity MRI are implantable medical devices from Abbott Laboratories USA. Multiple Abbott Laboratories pacemaker products are vulnerable to incorrectly encrypting sensitive data, with the Accent and Anthem pacemakers transmitting unencrypted patie...

Gratipay: Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domain

Good evening team! This is a theoretical risk but I thought it was still worth reporting since every endpoint and any data flowing through inside.gratipay.com is unencrypted. POC https://inside.gratipay.com And every sub directory under inside.gratipay.com. Description Since the certificate is on...

HP ERK-321A Wireless Mouse Spoofing Vulnerability

The HP ERK-321A is a wireless desktop device consisting of a mouse and keyboard. A spoofing vulnerability exists in the HP ERK-321A Wireless Mouse, which can be exploited by an attacker to launch a mouse spoofing attack due to unencrypted and unauthenticated mouse data communication...

CVE-2017-6297

The L2TP Client in MikroTik RouterOS versions 6.83.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and...

CVE-2016-9346

An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. Configuration data are stored in a file that is not encrypted...

CVE-2016-9346

CVE-2016-9346 affects Moxa MiiNePort E1 (before 1.8), E2 (before 1.4), and E3 (before 1.1). The issue is cleartext storage of configuration data in an unencrypted file, enabling potential information disclosure. NVD notes CVSS v3 base score 5.3 (L: Low impact on confidentiality) with network acce...

The vulnerability of the Windows operating system, which allows a malicious individual to intercept confidential information

Data related to Telnet protocol in the Windows operating system is transmitted in an unencrypted form. This allows a remote malicious individual to intercept confidential information, including user names and passwords, by analyzing network traffic...

Red Hat CloudForms Management Engine Information Disclosure Vulnerability

Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud service solutions from Red Hat, Inc. A security vulnerability exists in Red Hat CFME versions 5.4.4 CloudForms version 3.2 and 5.5.0 CloudForms version 4.0, which stems from the program...