7718 matches found
Overstepping Access Vulnerability in Rattle Car Rental App
Rattle Rental App is a car rental app. There is an overstepping access vulnerability in Ringer Rental Car APP. Attackers can use the vulnerability to capture packets to obtain sensitive information of other users...
A DJI Bug Exposed Drone Photos and User Data
Researchers found that they could compromise DJI's single sign-on tokens, similar to the issue behind Facebook's massive breach this September...
CCTV News App Has Override Access Vulnerability
CCTV News App is a portal news app software. CCTV News APP has an override access vulnerability . Attackers can use this vulnerability to directly query other users' information by grabbing packets and modifying UID parameters...
SaltOS Erp Crm 3.1 r8126 - Database File Download
SaltOS Erp Crm 3.1 r8126 - Database File Download Exploit Title: SaltOS Erp, Crm 3.1 r8126 - Database File Download Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.saltos.org/ Software Link: http://download.saltos.org/?app=saltos&format=xul&arch=win32 Version:...
Site security & user friendliness: Top E-commerce qualities for 2018
By Carolina It seems security breaches have not just become common, but prevalent throughout society. Between allegations of hacking into voting systems, and then into the most influential social media platforms, digital security has never been more critical. Users and businesses alike must do al...
UK Slaps Facebook with $645K Fine Over Cambridge Analytica Scandal
The UK has fined Facebook $645,000 over Cambridge Analytica’s data harvesting practices, which exploited the data of 87 million users of the social network. That represents a gnat bite for the tech giant, which generated $5.1 billion in net profit in the second quarter of the year. However, the...
Facebook Fined £500,000 for Cambridge Analytica Data Scandal
Facebook has finally been slapped with its first fine of £500,000 for allowing political consultancy firm Cambridge Analytica to improperly gather and misuse data of 87 million users. The fine has been imposed by the UK's Information Commissioner's Office ICO and was calculated using the UK's old...
HPE UIoT Unauthorized Access Vulnerability Vulnerability
HPE UIoT is a suite of universal IoT platforms from Hewlett Packard Enterprise HPE, USA. The platform features data analytics, monetary safety and synchronization management. A security vulnerability exists in the DSM portal and DSM APIs in HPE UIoT. A remote attacker could exploit the...
bouncycastle: Information disclosure in GCMBlockCipher
It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...
Google to Encrypt Android Cloud Backups With Your Lock Screen Password
In an effort to secure users' data while maintaining privacy, Google has announced a new security measure for Android Backup Service that now encrypts all your backup data stored on its cloud servers in a way that even the company can't read it. Google allows Android users to automatically backup...
Academic Timetable Final Build 7.0 - Information Disclosure
Academic Timetable Final Build 7.0 - Information Disclosure \n"; printr$ver; echo "\n"; / Array sEcho = 10 iTotalRecords = 3 iTotalDisplayRecords = 3 aaData = Array 0 = Array 0 = testdb1 1 = testdb1 2 = ADMIN 3 = 6CC4E8CFFEAF202D7475BC906612F9A29A9C8117 1 = Array 0 = ADMIN 1 = admin 2 = ADMIN...
Academic Timetable Final Build 7.0 - Information Disclosure
\n"; printr$ver; echo "\n"; / Array sEcho = 10 iTotalRecords = 3 iTotalDisplayRecords = 3 aaData = Array 0 = Array 0 = testdb1 1 = testdb1 2 = ADMIN 3 = 6CC4E8CFFEAF202D7475BC906612F9A29A9C8117 1 = Array 0 = ADMIN 1 = admin 2 = ADMIN 3 = 4ACFE3202A5FF5CF467898FC58AAB1D615029441...
Shopify: H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link
Hi, This is unrelated to the Twine-template issue reported earlier as this would still be an issue if the template escape would be fixed. Background The incontextapplink is checked server-side if it's a correct shopifycloud.com-URL. The problem however is that userdata inside the URL is allowed. ...
IBM Security Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2018-24832)
IBM Security Key Lifecycle Manager formerly known as Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A security vulnerability exists in IB...
Google’s failure to disclose user data leak prompts closure of Google Plus
By Waqas Google has admitted that a bug was present in the API for the consumer version of Google Plus Google+ that let third-party developers’ access data of not just its users but also of their contacts and friends. Reportedly, data of up to 500,000 users could have been exposed to external...
Google+ is Shutting Down After a Vulnerability Exposed 500,000 Users' Data
Google is going to shut down its social media network Google+ after the company suffered a massive data breach that exposed the private data of hundreds of thousands of Google Plus users to third-party developers. According to the tech giant, a security vulnerability in one of Google+'s People AP...
CVE-2018-1753
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 148514...
CVE-2018-14810
WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior parse files and pass invalidated user data to an unsafe method call, which may allow code to be executed in the context of an administrator...
New Relic: [NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users
This is a similar IDOR that I've reported in the past - but I've found a bypass through a misconfiguration requiring pre-setup in both Alerts and Synthetics to work correctly. I'll show you what I mean: Steps to Reproduce From new user creation page: 1. Add a new user to the account...
