Grindr v2.1.1 iOS - (eMail) Session Vulnerability

Document Title: =============== Grindr v2.1.1 iOS - eMail Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1426 Release Date: ============= 2015-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 1426 Commo...

Adobe Flash Player latest Vulnerability, CVE-2 0 1 5-3 0 4 4: The camera and microphone can be remote control-vulnerability warning-the black bar safety net

Researchers recently found that Adobe Flash Player some version vulnerability exists, an attacker could exploit the vulnerability can be by means of PC built-in camera and microphone for the user to be monitored. Vulnerability description The Flash Player configuration panel there is a list of...

Caught on the web of any user of the password reset vulnerability-vulnerability warning-the black bar safety net

Phone reset password password reset operation is not associated with a specific phone number, the lead can be reset to any phone registration account password. 1. The following url returns a result, you can traverse all the mobile phones registered account: http://api1.fun.tv/ajax/getmobilevcode/...

X (Formerly Twitter): Fabric.io: Ex-admin of an organization can delete team members

When an admin is deleted from an organization, his access rights are not removed properly. This allows an ex-admin to delete team members from the organization. Before proceeding with attack, 1. Create an organization with two accounts. Lets say, VictimOrg - Victimadmin, Victimmember 2. Invite...

Vimeo: A user can enhance their videos with paid tracks without buying the track

It is possible to enhance videos with paid tracks without buying the track. Steps to verify: 1. Log into vimeo.com and navigate to https://vimeo.com/enhancer. 2. Click on any paid music track and note down the track id from the URL ex:...

SSL Export Cipher Suite (CVE-2015-0204; CVE-2015-1637)

Communication with SSL servers using weak, legacy "export-grade" cipher suites might be prone to attacks trying to intercept secure communications...

Cisco Meraki Systems Manager CSRF / XSS / Functionality Abuse

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Cisco Meraki Systems Manager Multiple Vulnerabilities Affected Versions: Cisco Meraki Systems Manager - Unknown Versions PDF:...

X (Formerly Twitter): Fabric.io - an app admin can delete team members from other user apps

It is possible for an app admin to delete all the team members from other apps for which he doesn't have access. To reproduce the attack, create two apps and add different user roles as below, VictimApp - Aliceadmin, Alicemember HackerApp - Hackeradmin, Hackermember Before proceeding with the...

HackerOne: Breaking Bugs as team member

It is possible to break a bug page front-end as a team member. This is how it's done: 1. Go to a bug. 2. Select "Change State" - "Triaged". 3. Enter a random comment. 4. Intercept the POST request, change "message" to "message". The status change will be saved but the message will be null and not...

CVE-2014-6465

Unspecified vulnerability in the Oracle Communications Session Border Controller component in Oracle Communications Applications SCX640m5 allows remote authenticated users to affect availability via unknown vectors related to Lawful Intercept...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Communications Session Border Controller component in Oracle Communications Applications SCX640m5 allows remote authenticated users to affect availability via unknown vectors related to Lawful Intercept...

CVE-2014-6465

Technical details for CVE-2014-6465 are not publicly provided in the supplied documents. The record notes an unspecified vulnerability in Oracle Communications Session Border Controller with remote authentication and availability impact; no specific exploit, affected versions, or fixes are disclo...

CVE-2014-6465

Unspecified vulnerability in the Oracle Communications Session Border Controller component in Oracle Communications Applications SCX640m5 allows remote authenticated users to affect availability via unknown vectors related to Lawful Intercept...

FBI Arrested CEO of 'StealthGenie' for Selling Mobile Spyware Apps

The Federal Bureau of Investigation FBI has arrested the CEO of a UK-based company for allegedly advertising and selling a spyware app to individuals who suspect their romantic partners of cheating on them. The dodgy cell phone spyware application, dubbed as StealthGenie, monitors victims’ phone...

Vulnerabilities in Android Apps That Allow Intercept of Messages, Photos Outlined

Researchers from the University of New Haven have taken to Youtube this week to publicize vulnerabilities in a dozen Android apps, including Instagram, Vine and OKCupid. Researchers at the University of New Haven’s Cyber Forensics Research and Education Group UNHcFREG have chosen to disclose the...

CVE-2014-3333

The server in Cisco Unity Connection 9.11 and 9.12 allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014...

Code injection

The server in Cisco Unity Connection 9.11 and 9.12 allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014...

CVE-2014-3333

The server in Cisco Unity Connection 9.11 and 9.12 allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the ability to read files within the context of the web-server user account, aka Bug ID CSCup41014...

Cisco Unity Connection HTTP Intercept Vulnerability

A vulnerability in Cisco Unity Connection Server could allow an authenticated, remote attacker to elevate privileges and obtain full access to the affected system. The vulnerability is due to improper privilege escalation. An attacker may be able to exploit this vulnerability by reading files...

Multiple Linksys Devices DHCP Information Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/10329/info It has been reported that the built-in DHCP server on these devices are prone to an information disclosure vulnerability. When attempting to exploit this issue, it has been reported that a denial of service...