Meeting and Hotel Booking Provider's Data Found in Public Amazon S3 Bucket

Leaks of personal and business information from unsecured Amazon S3 buckets are piling up. The latest belongs to Groupize, a Boston-area business that sells tools to manage small group meetings as well as a booking engine that handles hotel room-block reservations. Researchers at Kromtech Securit...

Fusion Router App for Android suffers from an overstepping access vulnerability

Fusion Router APP is a mobile network management tool for cell phones. The software works with Fusion Router to remotely view and manage the router, as well as set the internet time. Fusion Router APP for Android suffers from an overstepping access vulnerability, which can be exploited by an...

Hijacked Environment Variables

Overview The shadowsock package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real...

Hijacked Environment Variables

Overview The node-opencv package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real...

Hijacked Environment Variables

Overview The jquery.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real...

Hijacked Environment Variables

Overview The nodesqlite package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real...

Hijacked Environment Variables

Overview The nodefabric package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real...

Amusing phone call AliCloud OSS credentials have information leakage vulnerability

Amusing Phone is a communication APP that combines entertainment and security, developed and launched by Beijing Shusheng Mobile Technology Co. There is an information leakage vulnerability in the AliCloud OSS credentials of Tease Phone. The vulnerability is caused by credential leakage due to th...

Remote code execution

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST; Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST; Cisco DPC3939B firmware version dpc3939b-v303r204217-150321a-CMCST; Cisco DPC3941T firmware version DPC39412.5s3PRODsey; an...

CVE-2017-9521

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST; Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST; Cisco DPC3939B firmware version dpc3939b-v303r204217-150321a-CMCST; Cisco DPC3941T firmware version DPC39412.5s3PRODsey; an...

CVE-2017-9521

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST; Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST; Cisco DPC3939B firmware version dpc3939b-v303r204217-150321a-CMCST; Cisco DPC3941T firmware version DPC39412.5s3PRODsey; an...

Zoho ManageEngine Event Log Analyzer Cross-Site Scripting Vulnerability (CNVD-2017-26267)

Zoho ManageEngine Event Log Analyzer is the United States ZhuoHao Zoho company's set of systems, event log analysis software. A cross-site scripting vulnerability exists in Zoho ManageEngine Event Log Analyzer versions 11.4 and 11.5, which originates from a password being displayed in a cookie wi...

Ate little brother ali cloud oss credentials have information leakage vulnerability

The Aite Little Brother app is a service program. There is an information leakage vulnerability in the Aite Little Brother AliCloud oss credentials. The vulnerability stems from the accessKeyId and accessKeySecret, endpoint built into the mobile app, resulting in credential leakage. An attacker c...

UBUNTU-CVE-2017-10118

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JCE. Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network acces...

postgresql: pg_user_mappings view discloses foreign server passwords

It was found that the pgusermappings view could disclose information about user mappings to a foreign database to non-administrative database users. A database user with USAGE privilege for this mapping could, when querying the view, obtain user mapping data, such as the username and password use...

UBUNTU-CVE-2017-9841

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

rhosp-director: libvirtd is deployed with no authentication

A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default by director listening on 0.0.0.0 all interfaces with no-authentication or encryption. Anyone able to make a TCP connection to any comput...

Lost Android - Exported components, External URLs, Possible privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application Lost Android published at the 'play' market has multiple vulnerabilities...

CVE-2016-10362

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

Schneider Electric U.motion Builder css.inc Directory Traversal Vulnerability

U.motion Builder is a generator product from Schneider Electric France. A directory traversal vulnerability exists in Schneider Electric U.motion Builder css.inc. An attacker could exploit the vulnerability to expose files...