Parallel Override Vulnerability in SDCMS v1.6

SDCMS era website information management system is a product of Suzhou Fireworks Network Technology Co., Ltd. to asp + access for the development of the portal system. SDCMS v1.6 has a parallel override vulnerability. Attackers can use the vulnerability to illegally modify the user release...

Joomla! Component JE Photo Gallery 1.1 - categoryid SQL Injection

Joomla! Component JE Photo Gallery 1.1 - categoryid SQL Injection Exploit Title: Joomla! Component JE Photo Gallery 1.1 - SQL Injection Dork: N/A Date: 2018-11-26 Exploit Author: Ihsan Sencan Vendor Homepage: https://joomlaextensions.co.in Software Link:...

razorCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-26701)

razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. A cross-site request forgery vulnerability exists in the rars/user/data page in razorCMS version 3.4.8. A remote attacker can exploit this...

Get the message: Your shopper data is trying to tell you something

This article originally appeared in Internet Retailer As we head into the thick of the holiday shopping season, web teams must make sure the path from discovery to purchase is as easy and painless as possible. Knowing where potential fail points are ahead of time makes it easier to prepare, while...

BBC: MiSafes’ child-tracking smartwatches are ‘easy to hack’

Following our research on the MiSafes kids tracking watch we spoke to the BBC's Rory Cellan-Jones and Leo Kelion about the risks, and what consumers can do. We found that the devices didn't encrypt user data, and that each child's account wasn't secured. The result is that children's movements...

Traffic bank app has information leakage vulnerability

Traffic Bank App is a traffic management and trading platform software. Traffic Bank APP has information leakage vulnerability. Attackers tamper with packets by grabbing packets to obtain other users' information...

EZSA-2018-007 User data disclosure

More info at http://share.ez.no/community-project/security-advisories/ezsa-2018-007-user-data-disclosure...

Vulnerability in the "My Orders" section of the Eastern Presentation Society App

East Presentation Club APP is a convenient hotel booking platform. An override access vulnerability exists in the "My Order" section of Dongcheng Club APP. An attacker can traverse the key fields to obtain sensitive information of other users through packet capture...

Eastern Presentation Society APP has information leakage vulnerability

East Presentation Club APP is a hotel booking platform. An information disclosure vulnerability exists in the Dongcheng Club APP. It allows attackers to utilize a packet grabber tool to traverse the Key field to obtain sensitive information about other users...

Yaddo Hotel App Has Override Access Vulnerability

Yaddo Hotel APP is a hotel booking service software. A vulnerability exists in Yaddo Hotel APP for override access. An attacker traverses the chainId field by grabbing packets to obtain sensitive information about other users...

Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection

Exploit Title: Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: http://galaxy.alyx.pl/ Software Link: https://excellmedia.dl.sourceforge.net/project/galaxyforces/galaxy/0.5.8/galaxy-0.5.8.7z Version: 0.5.8 Category: Webapps...

The evolution of Microsoft Threat Protection, November update

At Ignite 2018, we announced Microsoft Threat Protection, a comprehensive, integrated solution securing the modern workplace across identities, endpoints, user data, cloud apps, and, infrastructure Figure 1. The foundation of the solution is the Microsoft Intelligent Security Graph, which...

Patched Facebook Vulnerability Could Have Exposed Private Information About You and Your Friends

In a previous blog we highlighted a vulnerability in Chrome that allowed bad actors to steal Facebook users’ personal information; and, while digging around for bugs, thought it prudent to see if there were any more loopholes that bad actors might be able to exploit. What popped up was a bug that...

Overstepping Access Vulnerability in Rattle Car Rental App

Rattle Rental App is a car rental app. There is an overstepping access vulnerability in Ringer Rental Car APP. Attackers can use the vulnerability to capture packets to obtain sensitive information of other users...

A DJI Bug Exposed Drone Photos and User Data

Researchers found that they could compromise DJI's single sign-on tokens, similar to the issue behind Facebook's massive breach this September...

CCTV News App Has Override Access Vulnerability

CCTV News App is a portal news app software. CCTV News APP has an override access vulnerability . Attackers can use this vulnerability to directly query other users' information by grabbing packets and modifying UID parameters...

SaltOS Erp Crm 3.1 r8126 - Database File Download

SaltOS Erp Crm 3.1 r8126 - Database File Download Exploit Title: SaltOS Erp, Crm 3.1 r8126 - Database File Download Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.saltos.org/ Software Link: http://download.saltos.org/?app=saltos&format=xul&arch=win32 Version:...

Site security & user friendliness: Top E-commerce qualities for 2018

By Carolina It seems security breaches have not just become common, but prevalent throughout society. Between allegations of hacking into voting systems, and then into the most influential social media platforms, digital security has never been more critical. Users and businesses alike must do al...

UK Slaps Facebook with $645K Fine Over Cambridge Analytica Scandal

The UK has fined Facebook $645,000 over Cambridge Analytica’s data harvesting practices, which exploited the data of 87 million users of the social network. That represents a gnat bite for the tech giant, which generated $5.1 billion in net profit in the second quarter of the year. However, the...

Facebook Fined £500,000 for Cambridge Analytica Data Scandal

Facebook has finally been slapped with its first fine of £500,000 for allowing political consultancy firm Cambridge Analytica to improperly gather and misuse data of 87 million users. The fine has been imposed by the UK's Information Commissioner's Office ICO and was calculated using the UK's old...