California Kills Phone Decryption Bill

Civil liberty groups and tech firms are celebrating the defeat of a controversial California bill that would have forced phone makers to decrypt their devices by court order. The proposed legislation, AB 1681, died when lawmakers refused to give the bill a vote. But opponents of the bill, who...

X (Formerly Twitter): niche s3 buckets are readable/writeable/deleteable by authorized AWS users

Hi All, I've discovered that the AWS buckets by niche, niche-s3-production, is accessible for authorized AWS users using the AWS command line tools. Issue As such, I have confirmed: - I can list all files in the bucket with the command aws s3 ls s3://niche-s3-production - I can copy files from th...

Jewel Jewels - Customized SSL, Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Jewel Jewels published at the 'play' market has multiple vulnerabilities...

Taptrip Enjoy Foreign Chat - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Taptrip Enjoy Foreign Chat published at the 'play' market has multiple vulnerabilities...

Pregnancy Stages - Base64 encoded String, Exported ContentProvider, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Pregnancy Stages published at the 'play' market has multiple vulnerabilities...

MGASA-2016-0122 Updated moodle packages fix security vulnerability

In Moodle before 2.8.11, teachers who otherwise were not supposed to see students' emails could see them in the participants list CVE-2016-2151. In Moodle before 2.8.11, Moodle traditionally trusted content from external DB, however it was decided that external datasources may not be aware of web...

Johns Hopkins Researchers: Crypto Flaws Endanger iMessage Integrity

When Apple released its iOS Security Guide for public consumption, it was an unprecedented look inside the security architecture behind its products. For cryptographer and professor Matthew Green and a team of four Johns Hopkins University graduate students, it was a road map to understanding not...

Scores of Serial Servers Plagued by Lack of Authentication, Encryption

Thousands of serial servers connected to the internet aren’t password protected and lack encryption, leaving data that transfers between them and devices they’re connected to open to snooping, experts warn. To make matters worse, the servers, manufactured by Taiwan-based networking device company...

IBM FlashSystem V9000 Cross-Site Request Forgery Vulnerability

IBM FlashSystem V9000 is a suite of all-flash enterprise storage solutions from IBM USA. The solution provides a full suite of disaster recovery tools including snapshots, cloning and replication to protect data security as well as virtualized configuration and performance management using IBM...

Weak Bank Password Policies Leave 350 Million Vulnerable, Say Researchers

Should passwords that protect your financial data be less secure than the ones used to lock up selfies, cat videos and tweets swapped on social networks? In a study that looked at the password strength required to access website account for Wells Fargo, Capital One and 15 other banks, researchers...

Crypto Panel Experts Clash on FBI-Apple Debate

SAN FRANCISCO—One would think that six of the smartest security people on the planet could come to some sort of collective conclusion on the FBI-Apple debate. But that wasn’t the case today during the annual Cryptographers’ Panel at RSA Conference. The debate over whether Apple should assist the...

CVE-2016-1152

CVE-2016-1152 concerns Cybozu Office, affected versions 9.9.0 through 10.3.0. The vulnerability allows a remote, authenticated user to bypass intended access restrictions and read or write plan data. The vectors are unspecified in the provided documents. CNVD and primary CVE records confirm the b...

Apple Can Still Read Your End-to-End Encrypted iMessages

If you are backing up your data using iCloud Backup, then you need you watch your steps NOW! In government fight against encryption, Apple has positioned itself as a staunch defender of its user privacy by refusing the federal officials to provide encryption backdoors into its products. When it...

Twitter State-Sponsored Attack Notification

Twitter’s decision to notify users when their accounts are targeted in state-sponsored attacks earned its share of praise. But Twitter’s silence in terms of specifics about the attacks—whether by choice or gagged by a National Security Letter—has foisted some anxiety upon those who were notified....

ownCloud: Exploiting unauthenticated encryption mode

The owncloud file storage encryption uses the AES encryption algorithm in CFB mode without any authentication. The encryption module is advertised as a way to use a potentially untrusted external storage 1. Let's assume someone uses owncloud with the encryption module and an untrusted storage and...

Microsoft Keeps Backup of Your Encryption Key on its Server — Here's How to Delete it

Have you recently purchased a Windows computer? Congratulations! As your new Windows computer has inbuilt disk encryption feature that is turned on by default in order to protect your data in case your device is lost or stolen. Moreover, In case you lost your encryption keys then don't worry,...

The vulnerability of the Oracle Database database management system allows a hacker to compromise information security.

The vulnerability of the Core RDBMS component of the Oracle Database management system is related to errors in the code. Exploiting this vulnerability can allow a malicious actor to compromise information security remotely...

Patent Troll — 66 Big Companies Sued For Using HTTPS Encryption

Are you Using HTTPS on your Website to securely encrypt traffic? Well, we'll see you in the court. At least, that's what CryptoPeak is saying to all big brands that utilize HTTPS on their web servers. BIG Brands Sued for Using HTTPS: 'Patent Troll' Texas-based company CryptoPeak Solutions LLC has...

Checkpoint Cross Site Scripting

Exploit Title: Checkpoint.com sub-domains Reflected XSS RXSS Date: 12/11/2015 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.checkpoint.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: checkpoint.com sub-domains Checkpoint description :...

CVE-2015-5021

Affected product: IBM InfoSphere Information Server (DataStage) 11.3 and 11.5. Description: A privilege/escalation vulnerability allows an authenticated DataStage user to bypass job-execution restrictions or view sensitive information via unspecified vectors. Root cause: not explicitly detailed i...