CVE-2017-13104

CVE-2017-13104 affects UberEATS: Uber for Food Delivery (iOS) version 1.108.10001; vulnerability stems from a hard-coded encryption key used by the app, enabling data stored with that key to be decrypted by anyone who has the key. Public CVSS metrics in the record show total base score 7.5 (HIGH)...

CVE-2017-13102

The CVE-2017-13102 entry concerns the iOS app Asphalt Xtreme: Offroad Rally Racing (Gameloft), version 1.6.0 (2017-08-13). The root cause is the use of a hard-coded encryption key, enabling data encrypted with that key to be decrypted by anyone who has the key. This vulnerability exposes stored d...

CVE-2017-13104 Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption

Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

DEF CON 2018: Telltale URLs Leak PII to Dozens of Third Parties

LAS VEGAS – When we order food online, book a plane ticket or purchase seats for a show, we often get an email confirmation with a handy link that, when clicked, takes us directly to our confirmation, with no need to log back into the site. These pages have our confirmation code, the ability to...

Top iPhone Supplier Battles WannaCry Infection

A top iPhone supplier, Taiwan Semiconductor Manufacturing Co. TSMC, has recovered from a WannaCry ransomware infection that impacted the majority of its fabrication tools. The incident could delay mobile phone shipments during the pre-holiday Fall rush, and reduce revenue for Taiwan’s largest...

cgit 1.2.1 - cgit_clone_objects() Directory Traversal

cgit 1.2.1 - cgitcloneobjects Directory Traversal There is a directory traversal vulnerability in cgitcloneobjects, reachable when the configuration flag enable-http-clone is set to 1 default: void cgitcloneobjectsvoid if !ctx.qry.path cgitprinterrorpage400, "Bad request", "Bad request"; return; ...

GCHQ on Quantum Key Distribution

The UK's GCHQ delivers a brutally blunt assessment of quantum key distribution: QKD protocols address only the problem of agreeing keys for encrypting data. Ubiquitous on-demand modern services such as verifying identities and data integrity, establishing network sessions, providing access contro...

Onwards and Upwards: Our GDPR Journey and Looking Ahead

At Imperva, our world revolves around data security, data protection, and data privacy. From our newest recruits to the most seasoned members of the executive team, we believe that customer privacy is key. For the better part of the last two years, Imperva has laid the foundation for our complian...

Connected Car Apps Open Privacy Hole For Used Car Owners

When we think about hacking connected cars, most of the research has been around difficult-to-exploit vulnerabilities that would allow someone besides the owner to do things such as control the infotainment system, unlock the car remotely or even take control of the steering mechanism. But it tur...

Boys Town Healthcare Data Breach Exposed Personal Details of Patients

Another day, Another data breach! This time-sensitive and personal data of hundreds of thousands of people at Boys Town National Research Hospital have been exposed in what appears to be the largest ever reported breach by a pediatric care provider or children's hospital. According to the U.S...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 on Windows has a password protection option; however, the level of protection might be inconsistent with some customers' expectations because the data is directly accessible in cleartext. Specifically, it stores customer data in unique directories...

CVE-2018-14607

CVE-2018-14607/14608 apply to Thomson Reuters UltraTax CS 2017 for Windows in a client/server setup. The issue is that customer records and bank account numbers are transferred in cleartext over SMBv2, enabling network sniffing and potential MITM attacks; the disclosed data includes full names, S...

CVE-2018-14608

Thomson Reuters UltraTax CS 2017 for Windows is affected by CVE-2018-14608. The vulnerability stems from storing customer data in plaintext in unique directories under %install_path%\WinCSI\UT17DATA\client_ID\file_name.XX17, which can be bypassed without authentication by inspecting the strings i...

Unspecified Vulnerability in Oracle Sun Systems Products Suite Sun ZFS Storage Appliance Kit Component (CNVD-2019-36185)

Oracle Sun Systems Products Suite is a suite of Sun systems products from Oracle Corporation.Sun ZFS Storage Appliance Kit AK is one of the ZFS storage appliance kits. A security vulnerability exists in the API frameworks subcomponent of the Sun ZFS Storage AK prior to version 8.7.18 component of...

CVE-2018-3048

Vulnerability in the Oracle Banking Corporate Lending component of Oracle Financial Services Applications subcomponent: Core module. Supported versions that are affected are 12.3.0, 12.4.0, 12.5.0, 14.0.0 and 14.1.0. Easily exploitable vulnerability allows low privileged attacker with network...

Design/Logic Flaw

Vulnerability in the Primavera Unifier component of Oracle Construction and Engineering Suite subcomponent: Core. The supported version that is affected is 16.x. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successf...

CVE-2018-3050

CVE-2018-3050 affects the Oracle Financial Services Applications’ Banking Corporate Lending component (subcomponent: Core module). Affected versions are 12.3.0, 12.4.0, 12.5.0, 14.0.0 and 14.1.0. The vulnerability enables a low-privilege attacker with network access via HTTP to compromise Oracle ...

CVE-2018-3003

Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications subcomponent: Fleet Management System Suite. The supported version that is affected is 9.x. Easily exploitable vulnerability allows unauthenticated attacker with logon to the...

CVE-2018-3066

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Options. Supported versions that are affected are 5.5.60 and prior, 5.6.40 and prior and 5.7.22 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocol...

CVE-2018-3025

CVE-2018-3025 is a vulnerability in the Oracle Banking Payments component of Oracle Financial Services Applications (Payments Core). Affected versions are 12.2.0, 12.3.0, 12.4.0, 12.5.0 and 14.1.0. The flaw is exploitable by a low-privilege attacker over HTTP with network access, leading to poten...