WordPress article2pdf 0.24 DoS / File Deletion / Disclosure Vulnerabilities

WordPress article2pdf plugin versions 0.24 and above suffer from resource exhaustion, arbitrary file download, and file deletion vulnerabilities. Product: article2pdf Wordpress plug-in Product Website: https://wordpress.org/plugins/article2pdf/ Affected Versions: 0.24 and greater The following...

Design/Logic Flaw

IBM Content Navigator 3.0CD could allow attackers to direct web traffic to a malicious site. If attackers make a fake IBM Content Navigator site, they can send a link to ICN users to send request to their Edit client directly. Then Edit client will download documents from the fake ICN website. IB...

MAGA 'Safe Space' App Developer Threatens Security Researcher

UPDATE A newly released 63red Safe mobile app that aims to help wary Trump supporters find “safe” and conservative-friendly places to wear Make America Great Again MAGA gear turns out to have a host of security issues, according to one researcher. Meanwhile, Scott Wallace, the Oklahoma-based mobi...

Nextcloud: Nextcloud domain and name of every user leaked to lookup server

Steps to reproduce: 0. Install and set up Nextcloud, optional: create a few random users 1. Apply the following patch to a standard Nextcloud server: patch diff --git a/settings/BackgroundJobs/VerifyUserData.php b/settings/BackgroundJobs/VerifyUserData.php index 56ebadff9c..76ed8b5ed3 100644 ---...

More than Half of Android apps ask for dangerous permissions. Is yours among?

By John Mason It wasn’t very long ago that I revealed that most free VPN services are provided as a front for the big corporations running them to collect user that. Spurred by the findings of that study, I decided to dig deeper to see how much of a threat, especially when it comes to user data,...

CVE-2018-12402

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resource...

Slack: Real Time Error Logs Through Debug Information

Summary: During the assessment, I have found the debug URL on slackb.com which is disclosing the World Wide real time error logs of Slack users. The information leaked includes the following: 1. User Device Information 2. Redacted Token 3. Client IP Address 4. Description 5. Session ID 6. Team ID...

Culture Unchained App Has Override Access Vulnerability

Culture Unchained App is a free e-reading application product. A vulnerability exists in Culture Read APP, which can be exploited by attackers to obtain information about other users...

Culture Unchained App Has Override Access Vulnerability

Culture Unchained App is a free e-reading application product. A vulnerability exists in Culture Read APP, which can be exploited by attackers to obtain information about other users...

Threats to users of adult websites in 2018

More graphs and statistics in full PDF version Introduction 2018 was a year that saw campaigns to decrease online pornographic content and traffic. For example, one of the most adult-content friendly platforms – Tumblr – announced it was banning erotic content even though almost a quarter of its...

SQL Injection Vulnerability in the front-end pa***.asp file of Eco Times Enterprise Online Bookkeeping Management System

EcoTime Enterprise Online Bookkeeping Management System is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and payable accounts, as well as company bookkeeping and other related financial...

SQL injection vulnerability in the front-end mo***_pa***_mo***.asp file of the Environmental Protection Era Enterprise Online Bookkeeping Management System.

EcoTime Enterprise Online Bookkeeping Management System" is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and accounts payable, as well as company's bookkeeping and other related financial...

SQL injection vulnerability in the front-end bi***_mo***.asp file of the EcoTimes Enterprise Online Bookkeeping Management System

EcoTimes Enterprise Online Bookkeeping Management System" is an online bookkeeping software, especially suitable for small and medium-sized enterprises, stores, etc. to manage cash flow accounts, accounts receivable and payable accounts, as well as the company's bookkeeping and other related...

SQL Injection Vulnerability in the front-end mo***_mo***.asp file of Eco-Era's online enterprise bookkeeping management system

EcoTime Enterprise Online Bookkeeping Management System is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and payable accounts, as well as company bookkeeping and other related financial...

SQL injection vulnerability in the front-end mo***_sh***_pa***.asp file of the Eco Times Enterprise Online Bookkeeping Management System.

EcoTime Enterprise Online Bookkeeping Management System is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and payable accounts, as well as company bookkeeping and other related financial...

SQL injection vulnerability in the frontend p***_r***.asp file of the EcoTimes Enterprise Online Bookkeeping Management System

EcoTimes Enterprise Online Bookkeeping Management System is an online bookkeeping software for small and medium-sized enterprises, stores, etc. It is suitable for managing cash flow accounts, accounts receivable and payable accounts, as well as company bookkeeping and other related financial...

Khan Academy: EMAIL SPOOFING

Hey KHANACADEMY, I have found Email Spoofing type of Vulnerability in your Website. Attacker can use your E-Mail to send emails to others. Email spoofing is the creation of email messages with a forged sender address. Because the core email protocols do not have any mechanism for authentication, ...

Dark Web hacker selling 126M accounts stolen from new data breaches

By Waqas A dark web hacker going by the online handle of "Gnosticplayers" is selling a massive trove of user data stolen after compromising websites of several popular companies. The data which amounts to over 126 million accounts includes emails and passwords, etc. and is currently available on...

The vulnerability of the Virtual Directory Manager component of the Oracle Virtual Directory user data storage service allows a perpetrator to gain unauthorized access to data and cause a partial service failure.

The vulnerability of the Virtual Directory Manager component of the Oracle Virtual Directory authentication storage service is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to gain unauthorized access to data and cause a partial service failur...

Google Play Cracks Down on Malicious Apps

Google Play is ramping up its offensive against malicious apps, which have continued to plague the official app store for Android devices over the years. In a Wednesday post, Andrew Ahn, product manager at Google Play, said that the number of app submissions that were rejected on the app...