Sichuan Jiayuan Electronic Technology Co., Ltd. has an overstepping access vulnerability in the Medjia Cloud

The MediKarma Cloud Platform is a forward-looking medical model solution under the "Internet+Medicine" model. Sichuan Jiayuan Electronic Technology Co., Ltd. medical good cloud WeChat registration platform there is an overstepping access vulnerability, the attacker can use the vulnerability to...

U.S. Dept Of Defense: Publicly accessible Order confirmations leaking User Emails on ███

Summary: I noticed that a user's order confirmation was publicly accessible leaking email information Description: An attacker can gleam sensitive information that is stored in the order confirmation file Impact Medium Step-by-step Reproduction Instructions...

NetIQ Sentinel Information Disclosure Vulnerability (CNVD-2018-06631)

NetIQ Sentinel is a security information and event management SIEM solution from US-based NetIQ. The solution collects, stores and analyzes log data and reports on it, as well as analyzing security event data in real time. A security vulnerability exists in NetIQ Sentinel versions prior to 8.1.x...

Facebook Onavo VPN app collects user data even when its off

By Carolina In February this year, Facebook started pushing its Android and iPhone This is a post from HackRead.com Read the original post: Facebook Onavo VPN app collects user data even when its off...

Make way for HTTPS - Starting July 2018, Google Chrome will mark all HTTP sites as "not secure"

Days of clear-text HTTP, the original but insecure foundation for data communication over the web, are numbered. Over the past few years, Google and others such as the Internet Architecture Board, Mozilla, and Apple have nudged developers to encrypt and authenticate their websites using HTTPS whi...

Hangzhou Dana Technology Co., Ltd. Shape and Color APP has arbitrary account login vulnerability

Shape and Color is a new app for identifying flowers and sharing nearby flowers launched by Hangzhou Dana Technology Co. An arbitrary account login vulnerability exists in the Shape and Color APP of Hangzhou Dana Technology Co. The vulnerability is due to the failure of the server side to...

Design/Logic Flaw

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this...

CVE-2018-0489

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this...

Weblication CMS Core & Grid v12.6.24 - XSS Vulnerabilities

Document Title: =============== Weblication CMS Core & Grid v12.6.24 - XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2121 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13002 CVE-ID: ======= CVE-2018-13002 Release Date:...

Makeup Busters App Has Information Leakage Vulnerability

Makeup Treasure APP is a makeup teaching APP based on Android system, the APP makeup information is practical and comprehensive, you can check tens of thousands of makeup tips to solve any needs in makeup. An information leakage vulnerability exists in Makeup Dictionary APP version 6.0.1. An...

Google Expands Play Marketplace Bug Bounty Program

UPDATE Google is expanding the number of bounties available in its Google Play Security Reward Program, a step that comes amid a flurry of mitigation activities against malicious apps found in its official marketplace. The company introduced the program in October, in a long-awaited move...

Atlassian Bamboo Cross-Site Request Forgery Vulnerability

Atlassian Bamboo is a suite of continuous integration build tools from Atlassian Australia. The tools help development teams build, test, release and deploy projects using continuous delivery capabilities. A cross-site request forgery vulnerability exists in the update user administration resourc...

Grammarly Patches Chrome Extension Bug That Exposed Users’ Docs

UPDATE Grammarly has fixed a bug with its Chrome browser extension that exposed its authorization tokens to websites, allowing sites to assume the identity of a user and view their account’s documents. “I’m calling this a high severity bug, because it seems like a pretty severe violation of user...

CVE-2017-18042

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery CSRF vulnerability...

CVE-2017-18042

The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery CSRF vulnerability...

CloudBees Jenkins Information Disclosure Vulnerability (CNVD-2018-03628)

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . A...

Hacker compromised user data & illegally used car sharing service 33 times

By Waqas A 37-year old IT security researcher and self-confessed computer hacker This is a post from HackRead.com Read the original post: Hacker compromised user data & illegally used car sharing service 33 times...

CVE-2018-6032

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page...

CVE-2018-6036

Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page...

Tinder flaw exposes user swipe, match and photos to strangers

By Waqas Tinder is an online dating app that was launched in This is a post from HackRead.com Read the original post: Tinder flaw exposes user swipe, match and photos to strangers...