DEBIAN-CVE-2017-7787

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

Buffer overflow

Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. This...

CVE-2017-7813

CVE-2017-7813 affects Firefox versions earlier than 56.0. Root cause: in the JavaScript parser, casting an integer to a narrower type can cause data read from outside the buffer to be parsed. Impact: typically results in a non-exploitable crash, but may leak a limited amount of memory information...

IBM Security Access Manager Appliance Information Disclosure Vulnerability (CNVD-2018-11238)

IBM Security Access Manager Appliance is an application for information security management from IBM, USA. The program enables access management control through an integrated appliance for web, mobile and cloud computing. An information disclosure vulnerability exists in IBM Security Access Manag...

CloudPets May Be Out of Business, But Security Concerns Remain

More than a year after CloudPets connected teddy bears were found to have exposed 2.2 million voice recordings between parents and their children in a significant data breach, Amazon, Target and Walmart have pulled the toys from their online markets. But it’s the installed base of the connected...

DNA Testing Service MyHeritage Leaks User Data of 92 Million Customers

Account data tied to 92 million users of the genealogy and DNA testing service MyHeritage were found on a third-party “private” server in a breach that exposed usernames and passwords of customers. The breach is the largest since last year’s Equifax leak of 147.9 million pieces of private data...

A week in security (May 21 – May 27)

Last week we told you about a Mac cryptominer using XMRig, an overview of Dreamcast related scams, part 1 of decoding Emotet, and what to do about bad coding habits that die hard. We also published the results of our second CrackMe contest. Other news How a pioneer of machine learning became one ...

Cscms v3.53.5 SQL Injection Vulnerability in Frontend

Cscms is a diversified content management system developed using PHP5+MYSQL as the technical basis. Cscms v3.53.5 has a SQL injection vulnerability in the frontend. An attacker can exploit the vulnerability to obtain sensitive information from the database...

CVE-2017-9637

Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity to those databases is configured to use a SQL user name and password, an attacker may be able to sniff details from the connection string. Schneider Electric recommends that...

CVE-2017-2603

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

Design/Logic Flaw

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

CVE-2017-2603

CVE-2017-2603 affects Jenkins prior to 2.44 and 2.32.2, where the config.xml API used for disconnected agents can disclose user data. The root cause is a flaw in how the API handles agent disconnects, causing user objects to be included in API output and potentially exposing sensitive information...

Tracking tens of thousands of kids worldwide

tl;dr Gator Watch - a GPS watch for kids - is leaking data in all ends and anyone on the Internet can live track your kid. We're not talking about a security vulnerability, we're talking about non-existing security. Summary Who: Gator Watch Severity level: Critical Reported: August 2017 Reception...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

SUSE-SU-2018:1070-1 Security update for rzsz

This update for rzsz fixes the following issues: - L3: sz of rzsz segfaults in zsdata bsc1086416 - VUL-0: CVE-2018-10195: rzsz: sz can leak data to receiving side bsc1090051 - rzsz-0.12.20-976.7: illegal use of freed variable bsc529899 - /usr/bin/lsb segfaults rzsz bsc1076576...

chromium-browser: Same origin policy bypass in Service Worker

A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page...

Chris Vickery Discusses Data Leak of 48 Million Users by Private Intelligence Firm

SAN FRANCISCO – Profile data of 48 million users that was scraped from social networks and websites ranging from Facebook, LinkedIn, Zillow and Twitter was leaked by a private intelligence agency. The data was left on an Amazon S3 storage bucket accessible without a password by Localblox, the...

Lutron Quantum 3.2.243 Information Disclosure

Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

Lutron Quantum 2.0 - 3.2.243 - Information Disclosure

''' Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

Leaking ads

When we use popular apps with good ratings from official app stores we assume they are safe. This is partially true – usually these apps have been developed with security in mind and have been reviewed by the app store's security team. However, we found that because of third-party SDKs many popul...