BMW in-car infotainment system ConnectedDrive aeration remote control 0day vulnerabilities-vulnerability warning-the black bar safety net

! ConnectedDrives is the BMW car infotainment system, The system can move the APP to manage the vehicle. In addition to the APP, the system also provides a complete Web application. Vulnerability lab security researcher BenjaminKunz Mejri in to the BMW official submission of a vulnerability five...

The vulnerability of the automated system for managing technological processes of SIMATIC WinCC OA allows a malicious individual to elevate their privileges level.

The vulnerability of the SIMATIC Winn CC OAM software lies in the use of a weak hashing algorithm for hashing user account data. Exploiting this vulnerability allows a malicious individual to elevate their privileges by using a brute-force method...

CVE-2016-5231

Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and delete user data via a crafted app...

CVE-2016-5231

Summary: CVE-2016-5231 affects Huawei Mate 8 and related NXT/NXT variants (NXT-AL, NXT-CL, NXT-DL, NXT-TL) prior to certain build revisions. The issue allows an attacker to bypass permission checks and delete user data via a crafted app. The vulnerability is linked to Huawei’s security advisories...

Cross-site scripting vulnerability

A cross-site scripting vulnerability exists in the web interface whereby data provided by the user is stored without sanitization. Ref 90635 CVE-2016-2219. This issue affects the management interface of the device, where an authenticated administrator may be tricked into injecting malicious...

Bomgar Remote Support - Unauthenticated Code Execution (Metasploit)

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Bomgar Remote Support Unauthenticated Code Execution', 'Description' = %q Thi...

LebiShop Mall Log Unauthorized Access Vulnerability

LebiShop mall system is an online mall system using ASP.NET language. The system is widely used in small and medium-sized e-commerce enterprises. The payment-related log information of this mall system is stored in the Web directory and uses date commands, and the log files leak sensitive...

53快服平台某漏洞涉及760w用户信息+百万聊天工人信息+消息

简要描述： RT 详细说明： post注入语法：sqlmap.py -r 6.txt -D talk --count --tables 延迟注入慢的不行跑了25小时左右 ======================数据包========================= POST /lword.php HTTP/1.1 Host: www5.53kf.com Proxy-Connection: keep-alive Content-Length: 364 Origin: http://www5.53kf.com User-Agent: Mozilla/5.0 Windows NT 6.1...

China wants Apple's Source Code, but the Company Refused

In Brief Apple's head of legal has denied all rumors about providing its complete source code or any backdoor to the Chinese government. Apple officially confirmed that the Chinese government has asked Apple twice in the past two years to hand over the source code for its operating system, but th...

Google Stresses Transparency in New Chrome Web Store Policies

Google last week put app developers on notice, urging them to comply with a new set of privacy policies that it plans on enforcing starting this summer designed to better promote transparency. The rules reflect an update to Google’s User Data Policy for the Chrome Web Store. The company has porte...

SAP NetWeaver Java AS RTC Service Information Disclosure Vulnerability

SAP NetWeaver is SAP's integrated technology platform and the technology foundation for all SAP applications since SAP Business Suite. A security vulnerability exists in the chat function of the RTC service in SAP NetWeaver Java AS version 7.4, which can be exploited by remote attackers to obtain...

Reddit Removes NSL Warrant Canary from Transparency Report

Reddit’s latest transparency report is missing a nugget of information that was present in a previous report. Last year’s report included a warrant canary which stated that as of Jan. 29, 2015, Reddit had never received a National Security Letter, Foreign Intelligence Surveillance Court order or...

Uber: Possibility to enumerate and bruteforce promotion codes in Uber iOS App

Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo. Thanks, @r0t! Uber has a feature in the iOS app to apply a promotion...

Requests for Yahoo User Data Spiked After Paris Terror Attacks

Yahoo’s latest transparency report, published today, reflects a spike in government and law enforcement requests for user data following the Paris terrorist attacks of Nov. 13. The attacks resulted in the deaths of 130 people and injuries to more than 350 others; the situation remains fluid with...

EMC Documentum xCP Information Disclosure Vulnerability

EMC Documentum xCP is a development platform from EMC that uses automated information-intensive processes to help users make business decisions. The platform provides real-time visibility, content analytics and business insights. A security vulnerability exists in the members/xcpmember API in EMC...

Debian DSA-3502-1 : roundup - security update

Ralf Schlatterbeck discovered an information leak in roundup, a web-based issue tracking system. An authenticated attacker could use it to see sensitive details about other users, including their hashed password. After applying the update, which will fix the shipped templates, the site...

Drupal Update Fixes 10 Vulnerabilities, One Critical

Developers at Drupal addressed 10 vulnerabilities in the content management system this week, including a critical access bypass issue that could have let users access certain elements thought to be blocked, and another issue that could lead to remote code execution. Through the critical access...

SAP NetWeaver Information Disclosure Vulnerability (CNVD-2016-01148)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in the Universal Worklist Configuration of SAP NetWeaver version 7.4. A remote...

Here's the Facebook Hacking Tool that Can Really Hack Accounts, But...

Yes, you heard me right. A newly discovered Facebook hacking tool actually has the capability to hack Facebook account, but YOURS, and not the one you desire to hack. How to Hack Facebook account? How to Hack my Girlfriends Facebook account? My boyfriend is cheating on me, How do I hack his...

The vulnerability of the Windows operating system, which allows a perpetrator to gain access to protected information

The vulnerability of the Windows operating system in the XML Core Services component, related to the ability to access data during document type declarations, allows attackers to gain access to sensitive user data such as names, passwords, or files on the hard drive...