Data Pours from Cloud—And ‘The Enemy is Us’

Accenture, Verizon, Dow Jones and Deep Root Analytics are just the tip of the iceberg when it comes to the millions of private records and sensitive enterprise data exposed on cloud backends this year. And the problem is getting worse not better. “The enemy is us,” said Chris Vickery, director of...

Apple macOS High Sierra APFS is vulnerable

Apple macOS High Sierra is a specialized operating system developed by Apple for Mac computers.APFS is one of the file system components for Apple devices. A security vulnerability exists in the APFS component of Apple macOS High Sierra versions prior to 10.13.1. The vulnerability can be exploite...

CVE-2017-15581

In the "Diary with lock" aka WriteDiary application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive...

Huawei FusionSphere Openstack Information Disclosure Vulnerability (CNVD-2017-33879)

Huawei FusionSphere and FusionSphere OpenStack FSO are both Huawei products. The former is a cloud operating system product developed based on the OpenStack framework, and the latter is FusionSphere's cloud platform software in ICT scenarios. Huawei FusionSphere Openstack suffers from an...

Apple Support iOS Application 1.1.1 Unencrypted Third Party Analytics Vulnerability

Apple Support iOS application versions 1.1.1 and below send potentially sensitive information such as mobile carrier, install date and time, number of app launches, device model, iOS version and screen resolution, unencrypted to a third party site Adobe Marketing Cloud. Apple Support iOS...

Information Disclosure Vulnerability in Multiple Cisco Products (CNVD-2017-33214)

Cisco IOS Software and so on are the products of the American Cisco Cisco company.Cisco IOS Software is a set of operating systems developed for the Cisco network equipment.DS 9222i Multiservice Modular Switch A switch device. An information disclosure vulnerability exists in the encryption...

Cisco Spark Hybrid Calendar Service Information Disclosure Vulnerability

A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive information in the unencrypted headers of an HTTP method request. The attacker could use this information to conduct additional reconnaissance attac...

Design/Logic Flaw

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "MobileBackup" component. It allows remote attackers to obtain sensitive cleartext information in opportunistic circumstances by leveraging read access to a backup archive that was supposed to hav...

The vulnerability of Kaspersky Internet Security for Android, related to the lack of encryption for certain log file files, allows a hacker to disclose confidential information.

The vulnerability of Kaspersky Internet Security for Android lies in the lack of encryption for certain files in the logging application. Exploiting this vulnerability can allow a malicious actor to disclose confidential information remotely...

IBM Spectrum Protect Information Disclosure Vulnerability (CNVD-2017-29916)

IBM Spectrum Protect formerly known as Tivoli Storage Manager is a suite of data protection platforms from U.S.-based IBM that provides organizations with a single point of control and management, and support for backup and recovery of virtual, physical and cloud environments of all sizes. An...

CVE-2017-1378

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875...

Design/Logic Flaw

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875...

CVE-2017-1378

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875...

CVE-2017-1378

IBM Spectrum Protect (formerly Tivoli Storage Manager) contains a local-credential disclosure when application tracing reveals unencrypted vCenter login details. Affected products include IBM Spectrum Protect Client (7.1.0.0–7.1.6.6; 6.4 and below are EOS) and IBM Spectrum Protect for Virtual Env...

CVE-2017-1378

IBM Spectrum Protect 7.1 and 8.1 formerly Tivoli Storage Manager disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IBM X-Force ID: 126875...

CVE-2017-1000113

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with...

Design/Logic Flaw

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file system access, or users with Extended Read access to the jobs it is used in, to retrieve those passwords. The Deploy to container Plugin now integrates with...

The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises from the lack of protection for operational data. This allows attackers to obtain product passwords in an unencrypted form.

The vulnerability of the StruxureWare Data Center Expert monitoring system relates to the lack of protection for operational data. Exploiting this vulnerability allows a malicious actor to obtain product passwords in an unencrypted form by reading the contents of the RAM...

The vulnerability of the microprogramming software used in Rockwell Automation’s Micrologix 1100 and Micrologix 1400 control systems lies in the lack of protection for operational data. This allows attackers to obtain user credentials in an unencrypted form by monitoring traffic between the browser and the server.

The vulnerability of the microprogramming software used in Rockwell Automation’s Micrologix 1100 and Micrologix 1400 controllers lies in the lack of protection for operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to obtain user credentials in unencrypted...

ERS Data System 1.8.1 Java Deserialization

Exploit Title: ERS Data System 1.8.1 Deserialize Vulnerability Google Dork: N/A Date: 9/21/2017 Exploit Author: West Shepherd Vendor Homepage: http://www.ersdata.com Software Link: www.ersdata.com/downloads/ErsSetup.exe Version: 1.8.1.0 Tested on: Windows 7 x86 CVE : CVE-2017-14702 Description: E...