CVE-2018-6036

CVE-2018-6036 is an integer underflow in WebAssembly within Google Chrome64-bit era (V8) that could allow a remote attacker to leak user data via a crafted HTML page. The vulnerability was fixed in the Chrome stable update 64.0.3282.119; affected products are Google Chrome released before that v...

CVE-2018-6035

Removed by vendor...

CVE-2018-6039

Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension...

WordPress FV Flowplayer 7.2.0.727 Cross Site Scripting

waraxe-2018-SA107 - Reflected XSS in FV Flowplayer Wordpress plugin ================================================================================ Author: Janek Vind "waraxe" Date: 20. September 2018 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-107.html Target description: FV...

How to Delete Hosting Connection configured in Citrix Studio

Deleting a connection can result in the deletion of large numbers of machines and loss of data. Ensure that user data on affected machines is backed up or no longer required. Before deleting a connection, ensure that: All users are logged off from the machines stored on the connection. No...

CVE-2018-2459

Users of an SAP Mobile Platform version 3.0 Offline OData application, which uses Offline OData-supplied delta tokens which is on by default, occasionally receive some data values of a different user...

No.1 Adware Removal Tool On Apple App Store Caught Spying On Mac Users

A highly popular top-tier app in Apple's Mac App Store that's designed to protect its users from adware and malware threats has been, ironically, found surreptitiously stealing their browsing history without their consent, and sending it to a server in China. What's more concerning? Even after...

Mac App Store apps are stealing user data

There is a concerning trend lately in the Mac App Store. Several security researchers have independently found different apps that are collecting sensitive user data and uploading it to servers controlled by the developer. This is referred to as exfiltrating the data. Some of this data is actuall...

CVE-2018-6598

An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent to factory reset the device programmatically because of com.android.server.MasterClearReceiver. This does not require any user interactio...

IBM WebSphere Commerce Information Disclosure Vulnerability (CNVD-2018-17090)

IBM WebSphere Commerce is a suite of e-business solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. An information disclosure vulnerability exists in IBM WebSphere Commerce. An attacker...

Recent App Issues Reveal Facebook’s Struggles to Temper Data Privacy Woes

Facebook was hit with a double privacy punch regarding data privacy on Wednesday. First, Facebook acknowledged in a public post that one of the apps on its platform, myPersonality, inappropriately shared 4 million users’ data with researchers. Also on Wednesday, The Wall Street Journal reported...

Eltex ESP-200 Information Disclosure Vulnerability

Eltex ESP-200 is a wireless router product. An information disclosure vulnerability exists in the Eltex ESP-200 using firmware version 1.2.0. An attacker can exploit this vulnerability to extract password hash information for all users...

Chrome Bug Allowed Hackers to Find Out Everything Facebook Knows About You

With the release of Chrome 68, Google prominently marks all non-HTTPS websites as 'Not Secure' on its browser to make the web a more secure place for Internet users. If you haven't yet, there is another significant reason to immediately switch to the latest version of the Chrome web browser. Ron...

WordPress Export Users To CSV 1.1.1 CSV Injection

Exploit Title: Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-08-14 Google Dork: N/A Vendor: Matt Cromwell Software Link: https://wordpress.org/plugins/export-users-to-csv/ Affected Version: 1.1.1 and before Acti...

Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)

Monstra-Dev 3.0.4 - Cross-Site Request Forgery Account Hijacking Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request ForgeryAccount Hijacking Date: 2018-08-04 Exploit Author: Nainsi Gupta Vendor Homepage: http://monstra.org/ Product Name: Monstra-dev Version: 3.0.4 Tested on: Windows 10...

Intuit Lacerte 2017 for Windows Information Disclosure Vulnerability

Intuit Lacerte 2017 for Windows is a tax filing software package from Intuit, USA. The software features automatic calculations, automatic diagnostics, and more. A security vulnerability exists in Intuit Lacerte 2017 for Windows, which originates in a client/server environment where the program...

WityCMS 0.6.2 Cross Site Request Forgery

...

WityCMS 0.6.2 - Cross-Site Request Forgery (Password Change)

input type="hidden" name="type" value=...

Reddit Breach Stems from SMS Two-Factor Authentication Breakdown

Reddit confirmed Wednesday that a hacker broke into its systems and has accessed user data – including email addresses and passwords for accounts. The company said in a post today that the compromise occurred between June 14 and June 18, and it detected the incident on June 19. “We learned that a...

CVE-2018-14280

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.1049. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...