Google launches 'Data Transfer Project' to make it easier to switch services

A lot of new online services are cropping up every day, making our life a lot easier. But it is always harder for users to switch to another product or service, which they think is better because the process usually involves downloading everything from one service and then re-uploading it all aga...

LocalTapiola: User Information Disclosure via the REST API - /?_method=GET

Basic report information Summary: browser access to www.lahitapiolarahoitus.fi/wp-json is restricted for general public but it is still be accessible through which User information is leaked. Description: By default Wordpress allow public access to Rest API to get information about all users...

Zomato: Phishing user to download malicious app could lead to leakage of User Access Token, Email, Name and Profile photo via exported RemoteService

Thanks @shivasurya for helping us keep @zomato secure : One of the service components in the Zomato Android app was open to bind a service connection AIDL So, if an attacker would have phished a user to download a malicious app, it could have lead to leakage of access token of the user that leads...

Facebook Faces £500,000 Fine in U.K. Over Cambridge Analytica Leak

Facebook has been fined £500,000 $664,000 in the U.K. after the country's data protection watchdog concluded that its data-sharing scandal broke the law, making it as the social network's first fine over the Cambridge Analytica scandal. Yes, £500,000—that's the maximum fine allowed by the UK's Da...

Code injection

The Touch Pal application can collect user behavior data without awareness by the user in Snapdragon Mobile and Snapdragon Wear...

Ebay Inc - CSRF Exploitation PoC of User Data Delete

Document Title: =============== Ebay Inc - CSRF Exploitation PoC of User Data Delete References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2053 Video: https://www.youtube.com/watch?v=KUenuqImsBs Release Date: ============= 2018-07-06 Vulnerability Laboratory ID VL-ID:...

Hiro: Can view all username leaked in https://core.blockstack.org

Hello team, This should be private hide all username who registered in blockstack.org the attacker can get the information of a user https://core.blockstack.org/v1/subdomains?page=10 i thought it is a demo users but i found my username in the list this should be private "demoaccount1.stealthy.id"...

Ebay Inc - CSRF Exploitation PoC of User Data Delete

Document Title: =============== Ebay Inc - CSRF Exploitation PoC of User Data Delete References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2053 Video: https://www.youtube.com/watch?v=KUenuqImsBs Release Date: ============= 2018-07-05 Vulnerability Laboratory ID VL-ID:...

More Federal Agencies Wrapped Up in Facebook Data Privacy Probe

The Securities and Exchange Commission, FBI, and the Department of Justice are now reportedly investigating the social media giant after it failed to disclose that more than the data of 70 million platform users had leaked through a third-party application, sources told the Washington Post, Monda...

Facebook Admits Sharing Users' Data With 61 Tech Companies

Facebook has admitted that the company gave dozens of tech companies and app developers special access to its users' data after publicly saying it had restricted outside companies to access such data back in 2015. It's an unusual clear view of how the largest social networking site manages your...

Typeform, Popular Online Survey Software, Suffers Data Breach

Typeform, the popular Spanish-based online data collection company specializes in form building and online surveys for businesses worldwide, has today disclosed that the company has suffered a data breach that exposed partial data of its some users. The company identified the breach on June 27th,...

Ransomhack; a new attack blackmailing business owners using GDPR

By Waqas Hackers are threatening companies to leak stolen user data online This is a post from HackRead.com Read the original post: Ransomhack; a new attack blackmailing business owners using GDPR...

CVE-2018-0373

A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could allow an authenticated, local attacker to cause a denial of service DoS condition on an affected system. The vulnerability is due to improper...

CVE-2018-12565

An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load instead of yaml.safeload when parsing user data, remote code execution can occur...

Linaro LAVA Remote Code Execution Vulnerability

Linaro LAVA is an automated verification system. The system is primarily used to test the deployment of device systems based on ARM cores. A security vulnerability exists in Linaro LAVA versions prior to 2018.5.post1, which stems from the program using the 'yaml.load' function instead of the...

Security Bulletin: Open Redirection in IBM Tivoli Federated Identity Manager (CVE-2014-3097)

Summary In certain cases, IBM Tivoli Federated Identity Manager does not handle end user provided data before using that data to construct an HTTP redirect request. Vulnerability Details CVE ID: CVE-2014-3097 DESCRIPTION: In certain cases, IBM Tivoli Federated Identity Manager does not correctly...

PvPGN Stats SQL Injection Vulnerability

PvPGN Stats is a PHP-based tool that supports the integration of websites with the PvPGN game server, displaying server status, ladder pages, and more. A SQL injection vulnerability exists in the ladder/stats.php file in PvPGN Stats version 2.4.6, which stems from the program not filtering databa...

Dixons Carphone breach: Millions of card and user data compromised

By Waqas A prominent United Kingdom-based retailer has suffered a massive data This is a post from HackRead.com Read the original post: Dixons Carphone breach: Millions of card and user data compromised...

Amazon Fire TV & Fire TV Stick hit by crypto mining Android malware

By Waqas A traditional malware aims at stealing user data or keep This is a post from HackRead.com Read the original post: Amazon Fire TV & Fire TV Stick hit by crypto mining Android malware...

CVE-2018-5152

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API. For example, this allows for the interception of username and an encrypted password during login to Firef...