This Week in Security News: HR and Heritage Hacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, the details of 92 million accounts for MyHertitage were discovered on a private server outside of the company. Also, companies using service...

americanheritage.yourdictionary.com XSS vulnerability

Open Bug Bounty ID: OBB-615375 Description| Value ---|--- Affected Website:| americanheritage.yourdictionary.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

heritagecapitals.com.ng XSS vulnerability

Open Bug Bounty ID: OBB-608052 Description| Value ---|--- Affected Website:| heritagecapitals.com.ng Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

english-heritage.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-600558 Description| Value ---|--- Affected Website:| english-heritage.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

gnosallparishcouncil.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-533601 Description| Value ---|--- Affected Website:| gnosallparishcouncil.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-9584

The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9584

The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9584

The CVE-2017-9584 entry concerns the iOS app HBO Mobile Banking (Heritage Bank of Ozarks), version 3.0.0 (hbo-mobile-banking/id860224933). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive informati...

heritagepropertyservices.co.uk XSS vulnerability

Vulnerable URL: http://www.heritagepropertyservices.co.uk/properties/gallery/?FormSearchText=York"'--!==geopoints=53.962301=-1.081884=9.5=1=gallery=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

newyorkculturalheritagetourismnetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-246221 Description| Value ---|--- Affected Website:| newyorkculturalheritagetourismnetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

World Heritage in Iran - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application World Heritage in Iran published at the 'play' market has multiple vulnerabilities...

heritagehomescny.com XSS vulnerability

Open Bug Bounty ID: OBB-206671 Description| Value ---|--- Affected Website:| heritagehomescny.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

heritage-week.govspace.gov.au XSS vulnerability

Vulnerable URL: https://heritage-week.govspace.gov.au/whats-on/?startDate=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown ...

Family Heritage: House Secrets - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Family Heritage: House Secrets published at the 'play' market has multiple vulnerabilities...

CVE-2014-6771

The United Heritage Mobile aka FiMobile.UHCU application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6771

CVE-2014-6771 affects the United Heritage Mobile (Fi_Mobile.UHCU) Android app version 1.1. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and steal sensitive information via a crafted certificate. The da...

CVE-2014-6771

The United Heritage Mobile aka FiMobile.UHCU application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Unfixed XSS vulnerability at www.ontarioheritageconnection.org

Security researcher jath, has submitted on 17/09/2009 a cross-site-scripting XSS vulnerability affecting www.ontarioheritageconnection.org, which at the time of submission ranked 7146267 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/09/200...

Buffer-overflow in Tincat 2 minor than 2.0.28 (Sacred, Settlers 5 and others)

Luigi Auriemma Application: Tincat network library http://www.tincat.de Versions: Release 2 2.0.28 Release 1 should be not vulnerable Games: - Sacred = 1.8.2.6 - The Settlers: Heritage of Kings = 1.02 - other applications, a partial list in german is available at the following link but I cannot...