CVE-2017-2603

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

Design/Logic Flaw

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens SECURITY-362...

CVE-2017-2603

CVE-2017-2603 affects Jenkins prior to 2.44 and 2.32.2, where the config.xml API used for disconnected agents can disclose user data. The root cause is a flaw in how the API handles agent disconnects, causing user objects to be included in API output and potentially exposing sensitive information...

Tracking tens of thousands of kids worldwide

tl;dr Gator Watch - a GPS watch for kids - is leaking data in all ends and anyone on the Internet can live track your kid. We're not talking about a security vulnerability, we're talking about non-existing security. Summary Who: Gator Watch Severity level: Critical Reported: August 2017 Reception...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

SUSE-SU-2018:1070-1 Security update for rzsz

This update for rzsz fixes the following issues: - L3: sz of rzsz segfaults in zsdata bsc1086416 - VUL-0: CVE-2018-10195: rzsz: sz can leak data to receiving side bsc1090051 - rzsz-0.12.20-976.7: illegal use of freed variable bsc529899 - /usr/bin/lsb segfaults rzsz bsc1076576...

chromium-browser: Same origin policy bypass in Service Worker

A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page...

Chris Vickery Discusses Data Leak of 48 Million Users by Private Intelligence Firm

SAN FRANCISCO – Profile data of 48 million users that was scraped from social networks and websites ranging from Facebook, LinkedIn, Zillow and Twitter was leaked by a private intelligence agency. The data was left on an Amazon S3 storage bucket accessible without a password by Localblox, the...

Lutron Quantum 3.2.243 Information Disclosure

Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

Lutron Quantum 2.0 - 3.2.243 - Information Disclosure

''' Exploit Title: Login bypass and data leak - Lutron Quantum 2.0 - 3.2.243 firmware Date: 20-03-2018 Exploit Author: David Castro Contact: https://twitter.com/SadFud75 Vendor Homepage: http://www.lutron.com Software Link:...

Leaking ads

When we use popular apps with good ratings from official app stores we assume they are safe. This is partially true – usually these apps have been developed with security in mind and have been reviewed by the app store's security team. However, we found that because of third-party SDKs many popul...

UBUNTU-CVE-2018-9860

An issue was discovered in Botan 1.11.32 through 2.x before 2.6.0. An off-by-one error when processing malformed TLS-CBC ciphertext could cause the receiving side to include in the HMAC computation exactly 64K bytes of data following the record buffer, aka an over-read. The MAC comparison will...

Fedora 26 : libvncserver (2018-43541091ab)

This release fixes a possible sensitive data leak and a memory exhaustion when handling ClientTextCut messages of the RFB protocol. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatical...

Panera Bread Slammed After Sitting On Massive Data Leak For Eight Months

Panera Bread has shut down a massive data leak that revealed the information of potentially millions of customers via its website. The data was exposed for up to eight months after the company was first notified of the security threat. The incident has shed light on how organizations handle...

Facebook Fallout Continues as Politicians Call For Legal Action

A legal backlash against Facebook’s latest controversy is starting to gain momentum. Lawmakers from around the country are calling for investigations into Facebook after the company revealed that the data of 50 million platform users had leaked through a third-party app. Both New York and...

TrueCrypt Integer Overflow Vulnerability

TrueCrypt is an open source virtual encryption disk encryption software that creates virtual disks on your hard drive without generating any files. An integer overflow vulnerability exists in TrueCrypt version 7.1a. A local attacker can exploit this vulnerability to obtain sensitive information o...

Walmart Jewelry Partner Exposes Personal Data Of 1.3M Customers

A misconfigured Amazon S3 Simple Storage Service bucket, managed by a Walmart jewelry partner, left personal details and contact information of 1.3 million customers exposed to the public internet. The S3 repository containing a MSSQL database backup belongs to MBM Company, a Chicago, Ill.-based...

chromium-browser: timing attack using svg filters

Displacement map filters being applied to cross-origin images in Blink SVG rendering in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

apr: Out-of-bounds array deref in apr_time_exp*() functions

An out-of-bounds array dereference was found in aprtimeexpget. An attacker could abuse an unvalidated usage of this function to cause a denial of service or potentially lead to data leak...

php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function

A data leak was found in gdImageCreateFromGifCtx in GD Graphics Library used in PHP before 5.6.31 and 7.1.7. An attacker could craft a malicious GIF image and read up to 762 bytes from stack...