Starbucks: Sidekiq web UI (Ruby background processing) accessible unauthenticated via https://gift-test.starbucks.co.jp/sidekiq/busy

Summary: I found the following URL, which appears to be running an Sidekiq web UI instance that is accessible unauthenticated: https://gift-test.starbucks.co.jp/sidekiq/busy Description: Sidekiq is used for Ruby background processing as I've learned, I'm not really familiar with it. The web UI ca...

Fedora 27 : php-horde-horde (2018-1de045298c)

Horde 5.2.20 - mjr SECURITY: Fix XSS vulnerability when rendering custom background colors in a sidebar row Bug 14857. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

September 20, 2018—KB4457141 (OS Build 15063.1358)

None None...

Citrix Workspace app for Chrome / Citrix Receiver for Chrome Blanks out Background Application

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. Applications running in background app screen blanks out. Steps to Reproduce: 1. Open some...

AT&T Faces $224M Legal Challenge Over SIM-Jacking Rings

Cryptocurrency investor and Dogecoin founder Michael Terpin has filed a $223.8 million lawsuit against AT&T, alleging the mobile phone giant turned a blind eye to SIM fraud. Terpin alleges that more than 3 million cryptocurrency tokens worth $24 million were lifted from his digital wallet at an...

ThreatList: Almost Half of the World’s Top Websites Deemed ‘Risky’

Nearly half of the world’s most popular websites are risky places to visit, according to a fresh analysis of top Alexa sites. Vulnerable code, the running of active content from risky background sites, and large amounts of code downloads marked a good chunk of the top 50 websites used in all of t...

Code Execution Vulnerability in EmpireCMS

EmpireCMS is a free content management system CMS. EmpireCMS 7.5 and previous versions have a code execution vulnerability, the vulnerability stems from the database table name is not verified when backing up the database in the background, an attacker can modify the database table name, exploit...

Black Hat 2018: Google Bug Hunter Urges Apple to Change its iOS Security Culture

LAS VEGAS – Prolific Google bug hunter Ian Beer ripped into Apple on Wednesday, urging the iPhone maker to change its culture when it comes to iOS security. He said the company suffers from an all-too-common affliction of patching an iOS bug, but not fixing the systemic roots that contribute to t...

OpenEMR Remote Code Execution Vulnerability

OpenEMR is the open source electronic health record and medical practice management solution. OpenEMR suffers from a remote code execution vulnerability. Due to the failure to strictly filter incoming parameters when modifying configurations in the background, an attacker can exploit the...

Privilege Bypass Vulnerability in SeAssignPrimaryTokenPrivilege of Background Intelligent Transfer Service Service

The Background Intelligent Transfer Service service is an intelligent backup and transfer service for transferring data over a LAN using free network bandwidth. A privilege bypass vulnerability exists in SeAssignPrimaryTokenPrivilege of the Background Intelligent Transfer Service service under th...

CCleaner Adds Data Collection Feature With No Way to Opt-Out

Like many others, do you also believe that the popular system-cleaning tool CCleaner was performing well before Avast acquired the software from Piriform last year? If yes, then pop-up advertisements in the previous CCleaner software version was not the last thing you have to deal with. Avast has...

Grammarly: Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin

Summary: Attacker could trigger Grammarly extension's gnar.fetch command using a crafted page to perform XHR with cookies and any configurational params to any cross-origin resource. Description: Page could Init Grammarly popup editor no user gesture, helper Events have isTrusted property, which...

Grammarly: `open-url` command allows opening unlimited number of tabs pointing to arbitrary URLs

Summary Attacker could trigger Grammarly extension's open-url command to open any number of tabs pointing to any origin including internal, e.g. chrome:// and cause "infinite Chrome DoS" if attacker's page is pinned. Description Page could Init Grammarly popup editor no user gesture, helper Event...

Metinfo 6.1.0 SQL Injection Vulnerability in Background

MetInfo is a content management system developed using PHP and Mysql. Version 6.1.0 of the Metinfo website builder system has a SQL injection vulnerability in the background, which can be exploited by attackers to obtain sensitive database information...

Google Bans Cryptocurrency Mining Android Apps From the Play Store

Following Apple's lead in banning cryptocurrency mining apps, Google has also updated its Play Store policy this week to ban apps that mine cryptocurrencies on users' devices in the background. However, there are countless cryptocurrency mining apps, including MinerGate, AA Miner, NeoNeonMiner, a...

CVE-2018-14582

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

CVE-2018-14582

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

CVE-2018-14583

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account...

CVE-2018-14583

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account...

Code execution vulnerability in xdcms

xdcms is a fully open source and general purpose content management system. A code execution vulnerability exists in xdcms. The vulnerability is due to the background configuration page fails to completely filter the content submitted by the administrator due to the attacker can be exploited to...