WordPress Gtranslate Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Gtranslate versions prior to 2.8.52, which stems from...

CVE-2020-11813

In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...

CVE-2019-10620

Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24...

Input validation

Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24...

CVE-2019-10620

Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, MSM8996AU, QCN7605, SDM439, SDX24...

CVE-2020-11661

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...

CVE-2020-11661

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...

Improper access control

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...

CVE-2020-11661

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data...

49 malware infected Chrome extensions found stealing user data

By Sudais Asif Another day, another malware scam - In the latest, 49 security extensions on Google Chrome have been found to be engaging in malicious activities. This is a post from HackRead.com Read the original post: 49 malware infected Chrome extensions found stealing user data...

'Unbreakable' Smart Lock Draws FTC Ire for Deceptive Security Claims

The Federal Trade Commission has slapped Tapplock, the maker of smart padlocks that it bills as “unbreakable,” with an official complaint that could lead to fines down the road. The agency alleges that the company engaged in false and deceptive claims about its security practices, after the lock...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with L5.0/5.1 and M6.0 tablets software. The lockscreen interface allows Add User actions, leading to an unintended ability to access user data in external storage. The Samsung ID is SVE-2016-7797 March 2017...

CVE-2017-18680

CVE-2017-18680 concerns Samsung mobile devices running Lollipop (5.0/5.1) and Marshmallow (6.0) tablets. The issue arises from the lockscreen, where the Add User action can be exploited to access user data stored in external storage. Root cause and affected scope are tied to the lockscreen UI all...

How social media platforms mine personal data for profit

It’s almost impossible not to rely on social networks in some way, whether for personal reasons or business. Sites such as LinkedIn continue to blur the line, increasing the amount of social function over time with features and services resembling less formal sites, such as Facebook. Can anyone...

Information Disclosure Vulnerability in Panmicro e-cology (CNVD-2020-25557)

Panmicro e-cology is an efficient collaborative work environment for medium to large organizations. An information disclosure vulnerability exists in Panmicro e-cology, which can be exploited by attackers to obtain sensitive user information...

Unspecified Vulnerability in Deskpro (CNVD-2020-22252)

Deskpro is a helpdesk software solution that helps companies manage communication with their customers and user base across multiple channels. A security vulnerability exists in Deskpro. The /api/people endpoint fails to properly validate user permissions, which can be exploited by an attacker to...

CVE-2020-11464

An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privilege, allowing an attacker to retrieve sensitive information about all users registered on the system. This includes their full name, privilege, email address, phone number, etc...

Input validation

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data...

Reinstallation and Cross-Site Scripting Vulnerabilities in Blue Route Blog System

The Blue Route Blog System is a blog system that allows multiple users to collaborate on writing. The Blue Route Blog System suffers from reinstallation and cross-site scripting vulnerabilities, which can be exploited by an attacker to bypass reinstallation checks and reinstall the target website...

Spying on old folks

We’ve tested plenty of kids GPS tracker watches over the years. Nearly all we looked at had critical security issues. For a BBC show a while back we were asked to investigate the security of similar trackers for the elderly. They’re a nice idea; allowing people to live independently for longer an...