Vanilla: Forum Users Information Disclosure

Summary: An unauthorized even unauthenticated user is able to view some private information about forum users. this information includes: email address even if the user not allows it, IP address of the user, data of some of the private messages between two users. Description: by brute forcing...

New Relic: Bypass of my three other reports #267636 + #255894 + #271861 - (IDOR) Ability to see full name associated with other New Relic accounts

@jonbottarini discovered a regression in the way users are shown within the Alerts notification UI. This allowed him to reveal the first and last name of an existing registered user if their email was known, rather than showing an obfuscated version of that information. The application protects...

Android P Will Block Background Apps from Accessing Your Camera, Microphone

Yes, your smartphone is spying on you. But, the real question is, should you care? We have published thousands of articles on The Hacker News, warning how any mobile app can turn your smartphone into a bugging device—'Facebook is listening to your conversations', 'Stealing Passwords Using...

Massive Breach Exposes Keyboard App that Collects Personal Data On Its 31 Million Users

In the digital age, one of the most popular sayings is—if you're not paying, then you're not the customer, you're the product. While downloading apps on their smartphones, most users may not realize how much data they collect on you. Believe me; it’s way more than you can imagine. Nowadays, many...

CVE-2017-11022

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the...

Information disclosure

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the...

CVE-2017-11022

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the...

The Tor Project to Beef Up Privacy with Next-Generation of Onion Services

The Tor Project has made some significant changes to its infrastructure by improving the way the 'onion' network protects its users' privacy and security. Since the beginning, the largest free online anonymity network has been helping users browse the web anonymously, and its onion service provid...

CVE-2017-1000243

Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites...

ZKTime Web Software 2.0 - Improper Access Restrictions Vulnerability

Exploit for windows platform in category web applications Exploit Title: ZKTime Web Software 2.0 - Broken Authentication CVE-ID: CVE-2017-14680 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category:...

ZKTime Web Software 2.0 Insecure Direct Object Reference

Exploit Title: ZKTime Web Software 2.0 - Broken Authentication CVE-ID: CVE-2017-14680 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category: WebApps Author: Arvind V. Author Social: @FindArvind...

ZKTeco ZKTime Web 2.0.1.12280 Information Disclosure

Vulnerability Type: Broken Authentication Vendor of Product: ZKTeco Affected Product Code Base: ZKTime Web - 2.0.1.12280 Affected Component: ZK Time Web Interface Management. Attack Type: Local - Unauthenticated Impact: Information Disclosure ------------------------------------------ Product...

ZKTime Web Software 2.0 - Improper Access Restrictions

Exploit Title: ZKTime Web Software 2.0 - Broken Authentication CVE-ID: CVE-2017-14680 Vendor Homepage: https://www.zkteco.com/product/ZKTimeWeb2.0435.html Vendor of Product: ZKTeco Affected Product Code: ZKTime Web - 2.0.1.12280 Category: WebApps Author: Arvind V. Author Social: @FindArvind...

FBI Releases Article on Privacy Risks Associated with Internet-Connected Children's Toys

The Federal Bureau of Investigation FBI has released an article on the privacy risks associated with Internet-connected children's toys. FBI warns that Internet-connected toys may contain "sensors, microphones, cameras, data storage components, and other multimedia capabilities - including speech...

Google Changes How it Analyzes Misbehaving Mobile Apps

Mobile apps in the Google Play store are categorized by their purpose, i.e., productivity or games. But there is a science to how apps are arranged, in particular around security and privacy features, and especially in holding back those apps whose behaviors pose a risk to mobile users. Google on...

Telegram Agrees to Register With Russia to Avoid Ban, But Won't Share User Data

After being threatened with a ban in Russia, end-to-end encrypted Telegram messaging app has finally agreed to register with new Russian Data Protection Laws, but its founder has assured that the company will not comply to share users' confidential data at any cost. Russia's communications watchd...

Vulnerability in orderid parameter of China Telecom's handheld business hall app mall order page.

China Telecom Pocket Business Office is a cell phone terminal-based application software that provides users with recharge and payment, cost inquiries and other services. There is a vulnerability in the orderid parameter of the order page of the China Telecom Palm Business Hall app, which allows ...

About the security content of Safari 9.0.3 - Apple Support

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website. For information about...

HackerOne: Disclose any user's private email through API

Description: I have found a security vulnerability that allows an attacker to disclose any user's private email. An attacker can disclose any user's private email by creating a sandbox program then adding that user to a report as a participant. Now if the attacker issued a request to fetch the...

'Web Of Trust' Browser Add-On Caught Selling Users' Data — Uninstall It Now

Browser extensions have become a standard part of the most popular browsers and essential part of our lives for surfing the Internet. But not all extensions can be trusted. One such innocent looking browser add-on has been caught collecting browsing history of millions of users and selling them t...