Apple Patches iOS Ins0mnia Vulnerability

Apple’s monster security update of Aug. 13 included a patch for an iOS vulnerability that could beacon out location data and other personal information from a device, even if a particular task has been shut off by the user. A mobile app exploiting this vulnerability could also look benign enough ...

Universal Password Login Vulnerability in Public Opinion Service System of Fujian Communication Information Newspaper Co.

Fujian Communication Information Newspaper Co., Ltd. is a company that focuses on expanding the three major businesses of mobile publishing, mobile Internet, and public opinion control. A universal password login vulnerability exists in the Public Opinion Service System of Fujian Communication...

Firefox bookmarks extensions apps Pocket: vulnerability mining not so difficult-vulnerability warning-the black bar safety net

The Pocket application's developers recently fixed a few leaked data a vulnerability, hackers may be from the server to obtain WEB Services, internal IP address, as well as more sensitive information. Pocket profile Pocket formerly known as Read it Later, as the name suggests, is an online...

Apple iOS libxml2 User Information Disclosure Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in Apple iOS libxml2 processing of XML documents allows remote attackers to exploit the vulnerability to obtain sensitive user information...

Flippy My Life Stories 2.0 XSS Vulnerability

Flippy My Life Stories 2.0 is a CMS allowing to create a everyday story website. Usage Info 1: Go to http://website.fr/register.html 2: In "nickname" type Javascript code like alert2 3: Go to http://website.fr/userlogin.html and Log in 4: Click on "My Stories", it will lead you on the vulnerable...

Google to Expand Use of Safe Browsing to Stop Unwanted Software

Google is expanding the use of its Safe Browsing mechanism to warn users about a broader variety of unwanted software, in addition to the warnings they see regarding phishing pages, malware, and other threats. Safe Browsing is the service that Google uses to help protect Chrome users from malicio...

Enter: No rate limit which leads to "Users information Disclosure" including verfification documents etc.

HOST api.romit.io Endpoint /v0/cash/auth/login Issue When an attacker tries to login at app.romit.io, he is prompted to enter the PIN . There is no rate limit to verify this. Although there is a an authorization header Authorization: Credential=b67b0b10571ac00444de3cffde0b5b05,...

ThinkSNS 4.0 一处设计缺陷（可伪造任意人发朋友圈）

简要描述： 通常用于诈骗！ 详细说明： 官方的demo已经是4.0，可惜下不到源码 翻来看看ThinkSNS 3.0的源码，发现一处严重的设计缺陷 apps\public\Lib\Action\AccountAction.class.php 下doSaveProfile方法为保存用户信息操作 / 保存基本信息操作 @return json 返回操作后的JSON信息数据 / public function doSaveProfile $res = true; // 保存用户表信息 if!empty$POST'sex' $save'sex' = 1 == intval$POST'sex' ?...

Igreks MilkyStep Light and Professional Access Restriction Bypass Vulnerability

Igreks MilkyStep is a CGI for pushing magazines through the email system. A security vulnerability in the user-information management feature of Igreks MilkyStep Light and Professional allows remote attackers to bypass access restrictions and modify administrator credentials...

WordPress Users to CSV Plugin <= 1.4.5 - Cross Site Request Forgery (CSRF)

Because of this vulnerabiliy, user information can be exported via a GET request to users.php. Solution Disable the plugin...

CVE-2015-2952

The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than...

CVE-2015-2952

The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than...

MilkyStep fails to restrict access permissions

Overview MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep fails to restrict access permissions against the management function for user information CWE-284. Note that this vulnerability is different from JVN16409640 or JVN74280258. Kusano Kazuhik...

JVN#19732015: MilkyStep fails to restrict access permissions

MilkyStep provided by Igreks Inc. is a CGI for e-mail newsletter distribution management. MilkyStep fails to restrict access permissions against the management function for user information CWE-284. Impact A non-administrative user may be able to change administrative user credentials. Solution...

Qibo Blog /member/userinfo.php SQL注入漏洞

No description provided by source...

APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 are now available and address the following: WebKit Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite...

ThinkSNS某问题导致用户信息泄露

简要描述： 233 详细说明： demo.thinksns.com memcache 218.244.149.144:11211 漏洞证明：...

Security Advisory-Information Disclosure Vulnerability on E355s Mobile WiFi

E355s have an information disclosure vulnerability that could be exploited by an attacker to graft attack commands or capture network communications to obtain the configuration and user information without login Vulnerability ID: HWPSIRT-2015-02002. This Vulnerability has been assigned Common...

Dropbox Acquisitions: Get email ID of any user on hackpad.com

goto hackpad.com wherever you see the profile picture of the user right click and goto Inspect element you will get this: we can clearly see the email address of the user in the above tag and thus the User information is leaked!...

MediaWiki Cross-Site Request Forgery Vulnerability (CNVD-2015-02413)

MediaWiki is a Wiki program. A cross-site request forgery vulnerability exists in the MediaWiki CheckUser extension. A remote attacker can exploit this vulnerability to retrieve sensitive user information...