initroot: Bypassing Nexus 6 Secure Boot through Kernel Command-line Injection

In the May 2017 Android Security Bulletin, Google released a patch to a critical and unique vulnerability CVE-2016-10277 in the Nexus 6 bootloader we had found and responsibly disclosed. By exploiting the vulnerability, a physical adversary or one with authorized-ADB/fastboot USB access to the...

The Uber platform coming out of authentication vulnerabilities, exploit the vulnerability can reset any account password-loophole warning-the black bar safety net

Italian security expert Vincenzo C. Aka found the Uber platform authentication vulnerabilities, any account can use this vulnerability to reset the password, this discovery yesterday officially announced. In fact, the initiator of the“authentication crisis”the vulnerability is in the seven months...

Weblate: Information Disclosure on demo.weblate.org

Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. F185728 Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should so no changes should be made on the GitHub...

McAfee Network Data Loss Prevention Information Disclosure Vulnerability (CNVD-2017-07615)

McAfee Network Data Loss Prevention is a data leakage protection solution. McAfee Network Data Loss Prevention NDLP 9.3.x suffers from an information disclosure vulnerability in the server implementation, which can be exploited by a remote attacker to view user information via the device web...

OnePlus OTA Downgrade Vulnerability(CVE-2017-5948)

Products OnePlus 3T OnePlus 3 OnePlus 2 OnePlus X OnePlus One Vulnerable Version All OnePlus OxygenOS & HydrogenOS OTAs Technical Details lenient updater-script in the OnePlus OTAs which does not check that the current version is lower than or equal to the given image’s see below the 4.0.0...

Information Disclosure

github.com/openshift/origin is vulnerable to information disclosure. The vulnerability is possible because kubernetes watch cache does not return the correct data in a multi tenant environment, revealing the data of a user to another user...

Atlassian Resets HipChat Passwords Following Breach

Atlassian reset user passwords for its group chat service HipChat on Monday following an incident that may have resulted in unauthorized access to a server used by the service. The company began warning users Monday via email that as a result an attacker may have secured access to user informatio...

Hyundai Patches Leaky Blue Link Mobile App

Hyundai Motor America has patched a vulnerability in its Blue Link mobile application that exposed personal and vehicle information to an attacker. Updated versions of the app 3.9.6 were released to Google Play and the Apple App Store on March 8, a little more than one month after Rapid7 learned...

Google Pleads for Better Cross-Border Exchange of Digital Evidence

Google said it is receiving a growing number of cross-border requests for user data to be used as evidence in criminal prosecutions. The volume of requests is also exposing weaknesses in the existing process for exchanging data between countries called the Mutual Legal Assistance Treaties MLAT,...

Google Android Information Disclosure Vulnerability (CNVD-2017-04563)

Android is a cell phone operating system based on the Linux open kernel. Android has an information disclosure vulnerability during the factory settings restoration process that can be exploited by an attacker to access the previous user's data...

CIIC Xi'an Recruitment System Exploits Universal Password Login Vulnerability

CIIC Xi'an Recruitment System is a resume information saving and entry system. CIIC Xi'an Recruitment System suffers from a universal password login vulnerability. An attacker who enters the universal password 'or '1'='1 or 'or'='or' can log in and view sensitive user information...

Appointment Script - SQL Injection

Appointment Script - SQL Injection Exploit Title: Doctors Appointment Script - SQL Injection Google Dork: N/A Date: 05.04.2017 Vendor Homepage: http://appointment-script.com/ Software: http://appointment-script.com/demo Demo: http://appointment-script.com/demo Version: N/A Tested on: Win7 x64, Ka...

Appointment Script - SQL Injection

Exploit Title: Doctors Appointment Script - SQL Injection Google Dork: N/A Date: 05.04.2017 Vendor Homepage: http://appointment-script.com/ Software: http://appointment-script.com/demo Demo: http://appointment-script.com/demo Version: N/A Tested on: Win7 x64, Kali Linux x64 Exploit Author: Ihsan...

Maian Uploader 4.0 SQL Injection

Exploit Title: Maian Uploader Script v4.0 - SQL Injection Google Dork: N/A Date: 04.04.2017 Vendor Homepage: http://www.maiansoftware.com/ Software: http://www.maianuploader.com/?dl=yes Demo: http://www.maiansoftware.com/demos/uploader/ Version: 4.0 Tested on: Win7 x64, Kali Linux x64 Exploit...

Verizon to pre-install a 'Spyware' app on its Android phones to collect user data

If the death of online privacy rules wasn't enough for Internet Service Providers and advertisers to celebrate, Verizon has planned to pre-install spyware on customers' Android devices in order to collect their personal data. The telecom giant has partnered with Evie Launcher to bring a new...

TYPO3 Information Disclosure Vulnerability

TYPO3 is an open source content management system. An information disclosure vulnerability exists in TYPO3. The vulnerability is caused by sending an http request to the index.php?loginProvider URI in the https Referer. An attacker can exploit the vulnerability to obtain sensitive user informatio...

CVE-2017-7249

Multiple Cross-Site Scripting XSS were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data action, userid passed to the 'Gazelle-master/sections/tools/data/ocelotinfo.php' URL. An attacker could execute arbitrary HTML and script...

Cross site scripting

Multiple Cross-Site Scripting XSS were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data id passed to the 'slims7cendana-master/template/default/detailtemplate.php' and...

CVE-2017-6908

An issue was discovered in concrete5 = 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data fID passed to the "concrete5-legacy-master/web/concrete/tools/files/selectordata.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the...

Information leakage vulnerability in Yunmai Good Light APP

Yunmai Good Light APP is a special app for smart weight scale launched by Yunmai. There is an information leakage vulnerability in Yunmai Good Light APP. Since the entire APP only uses token as a security restriction, the token generation algorithm can be cracked to obtain sensitive information,...