Facebook May Face $5 Billion FTC Fine for Data Misuse

UPDATE Facebook may be facing fines as high as $5 billion after a year-long Federal Trade Commission FTC investigation into its data-security practices. Though it wasn’t mentioned in its earnings call on Wednesday, the social-media giant in a release for its Q1 2019 earnings said that it was...

21 Industrial Real Estate Information Dissemination System suffers from xss vulnerability

21Industrial real estate network provides the latest factory, warehouse, land and other information. An xss vulnerability exists in the 21 Industrial Real Estate information dissemination system, which can be exploited by attackers to obtain user information...

Poll: Facebook Harvests Email Contacts for 1.5M Users – Is Enough, Enough?

Another day, another Facebook issue. Earlier on Thursday, news broke that Facebook confirmed that it has harvested the email contact lists for 1.5 million people, in an ongoing effort since May 2016. The social network said the situation was “unintentional” – and that somehow, it just happened. A...

Facebook Collected Contacts from 1.5 Million Email Accounts Without Users' Permission

Not a week goes without a new Facebook blunder. Remember the most recent revelation of Facebook being caught asking users new to the social network platform for their email account passwords to verify their identity? At the time, it was suspected that Facebook might be using access to users' emai...

CVE-2019-1837

A vulnerability in the User Data Services UDS API of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the management GUI. The vulnerability is due to improper validation of input parameters in the UDS API...

CVE-2019-1837 Cisco Unified Communications Manager Denial of Service Vulnerability

A vulnerability in the User Data Services UDS API of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on the management GUI. The vulnerability is due to improper validation of input parameters in the UDS API...

ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ManageEngine Applications Manager 11.0 %q This module exploits sql and command injection vulnerability in the ManageEngine AM 14 and prior version...

Researchers: Facebook's Data-Leveraging Scandal Puts Users on Notice

On the heels of reports that Facebook leveraged its users’ data in its relationships with other companies, researchers say that the tech space needs to re-assess the value of data as it relates to user privacy measures. However, they also said that users need to take steps themselves to safeguard...

Oracle VirtualBox crServerDispatchGetVertexAttribdvNV Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Oracle VirtualBox. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

CVE-2018-17305

UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users even administrators leading to privilege escalation and remote code execution...

Design/Logic Flaw

The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application for Android, iOS, and Windows, do not prevent spoofing of the camera server. An attacker can create a fake camera server that listens for the client looking for a camera on the local network. When...

Facebook Data of Millions Exposed in Leaky Datasets

UPDATE Hundreds of millions of Facebook records – including account names, personal data, and more – have been found in two separate publicly-exposed app datasets. The first publicly-exposed dataset originates from a Mexico-based media company, Cultura Colectiva, and contains over 540 million...

Tianyi Life Jiangsu Telecom Palm Business Hall APP has multiple vulnerabilities

Tianyi Life Jiangsu Telecom Pocket Business Hall APP is a handheld service mobile software launched by Jiangsu Telecom. There are multiple vulnerabilities in Tianyi Life Jiangsu Telecom Handheld Business Office APP, which can be exploited by attackers to obtain sensitive user information...

CVE-2018-1625

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 144410...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2019-27591)

IBM Security Privileged Identity Manager ISPIM is an identity management product within the IBM Identity Governance and Management solution from IBM in the United States. The product is designed to protect, automate and audit the use of privileged identities to help defend against insider threats...

API server used by JR East Japan train operation information push notification App for Android fails to restrict access permissions

Overview JR East Japan train operation information push notification App for Android provided by East Japan Railway Company fails to restrict access permissions CWE-284. The application is no longer available/supported, and its service was ended in 2019 march 23. Tomoya Takahashi of TCU...

US Congress proposes comprehensive federal data privacy legislation—finally

The United States might be the only country of its size—both in economy and population—to lack a comprehensive data privacy law protecting its citizens’ online lives. That could change this year. Never-ending cybersecurity breaches, recently-enacted international privacy laws, public outrage, and...

Jfinal cms xss vulnerability at frontend user profile

Jfinal cms uses JFinal as a web framework , template engine with beetl, database with mysql, front-end bootstrap, flat ui and other frameworks. Support for multi-site , oauth2 authentication , account registration , password encryption , comments and replies , message alerts , site visits...

CVE-2018-14814

WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object...

CVE-2018-14814

WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object...