Deserialization of Untrusted Data in Apache Storm

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

Viral FaceApp Unnecessarily Requests Access to Users' Facebook Friends List

FaceApp—the AI-powered photo-morphing app that recently gone viral for its age filter but hit the headlines for its controversial privacy policy—has been found collecting the list of your Facebook friends for no reason. The Russian-made FaceApp has been around since the spring of 2017 but taken...

CVE-2019-14330

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

Facebook's Ex-Security Chief Details His 'Observatory' for Internet Abuse

Alex Stamos' Stanford-based project will try to persuade tech firms to offer academics access to massive troves of user data...

How to steal a million (of your data)

Any user data — from passwords for entertainment services to electronic copies of documents — is highly prized by intruders. The reason is simply that almost any information can be monetized. For instance, stolen data can be used to transfer funds to cybercriminal accounts, order goods or service...

The vulnerability of the Microsoft SharePoint software package arises from insufficient cleaning of data provided by users, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the Microsoft SharePoint software package is related to insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute cross-site scripting attacks with elevated privileges using a specially created...

The vulnerability of Microsoft Exchange Server servers arises from insufficient cleaning of data provided by users. This allows attackers to execute cross-site scripting attacks and execute arbitrary code in the context of the current user.

The vulnerability of Microsoft Exchange Server lies in insufficient cleaning of data provided by users. Exploiting this vulnerability allows a malicious actor to remotely execute cross-site scripting attacks and execute arbitrary code in the context of the current user, by sending a specially...

Adult Sites Lack Privacy, Open the Door for Harassment and Tracking

An analysis of 22,500 porn sites found that third-party tracking of users is rampant, privacy policies are difficult to understand and a majority fail to implement basic HTTPS encryption. In all, it’s a recipe for enabling sexual violence and shaming, according to an academic paper released this...

Information leakage vulnerability in the system of Sida Fluoroplastics Co.

Inadequate security filtering processing measures in this product allow users to obtain user information without authentication. By exploiting this vulnerability, an attacker can obtain user information without authorization http://60.191.211.210:8088/yyoa/assess/js/initDataAssess.jsp...

Facebook to Pay $5 Billion Fine to Settle FTC Privacy Investigation

After months of negotiations, the United States Federal Trade Commission FTC has approved a record $5 billion settlement with Facebook over its privacy investigation into the Cambridge Analytica scandal. The settlement will put an end to a wide-ranging probe that began more than a year ago and...

MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting

Exploit Title: MyT Project Management - Userusername Stored Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://manageyourteam.net/index.html Software Link: https://sourceforge.net/projects/myt/files/latest/download Version: 1.5.1 Category: Webapps Tested o...

Security Bulletin: IBM QRadar SIEM is vulnerable to an Information exposure (CVE-2019-4054)

Summary IBM QRadar SIEM could disclose potentially sensitive information about users during content export. Vulnerability Details CVEID: CVE-2019-4054 Description: IBM QRadar could allow a local user to obtain sensitive information when exporting content that could aid an attacker in further...

Zhucheng City Three Swords Network Media Co., Ltd. online shopping mall web system has xss vulnerability

Zhucheng City Three Swords Network Media Co., Ltd. is an Internet web application development company, which has built online shopping mall web systems for many customers. Zhucheng City Three Swords Network Media Co., Ltd. online shopping web system has xss vulnerability, the attacker can embed...

CVE-2019-13239

inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture...

Related vulnerabilities have now been patched: the Orvibo smart home devices disclosure of user information-bug warning-the black bar safety net

From Orvibo aspect to understand, this relates to the information disclosure of the security vulnerability has now been fixed, and the user information of the protection level, at the same time they also want and professional information security research team into cooperation with the protection...

agrupamento-fajoes.pt Cross Site Scripting vulnerability

Security Researcher ZeroNameless Helped patch 29 vulnerabilities Received 2 Coordinated Disclosure badges , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting agrupamento-fajoes.pt website and its users. Following coordinated and responsible...

CVE-2019-4382

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...

PT-2019-17050 · Ibm · Ibm Api Connect

Name of the Vulnerable Software and Affected Versions: IBM API Connect versions 5.0.0.0 through 5.0.8.6 Description: The issue allows an unauthorized user to obtain sensitive information about system users by using specially crafted HTTP requests. Recommendations: For versions 5.0.0.0 through...

Sign in with Apple

What's in a Login Button? All you need to know about the new "Sign in with Apple" For Akamai Identity Cloud, we intend to support our clients that wish to implement "Sign in with Apple" just like we do for Facebook, Google, Instagram, Twitter, LinkedIn and about 30 other Identity Providers. If yo...

dinosaurprotectiongroup.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-863836 Security Researcher CoderYounes Helped patch 1033 vulnerabilities Received 5 Coordinated Disclosure badges Received 8 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting...