Dating apps that track users from home to work and everywhere in-between

TL;DR We were able to precisely locate and track the users of four major dating apps, potentially putting at risk 10 million users This risk level is elevated for the LGBT+ community who may use these apps in countries with poor human rights where they may be subject to arrest and persecution. Ap...

Group sex app leaks locations, pics and personal details. Identifies users in White House and Supreme Court

We’ve seen some pretty poor security in dating apps over recent years; breaches of personal data, leaking users locations and more. But this one really takes the biscuit: probably the worst security for any dating app we’ve ever seen And it’s used for arranging threesomes. It’s 3fun. It exposes t...

Who Owns Your Wireless Service? Crooks Do.

Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptic...

Black Hat: LeapFrog Tablet Flaws Let Attackers Track, Message Kids

LAS VEGAS – Serious vulnerabilities have been disclosed in LeapFrog’s tablet for kids, the LeapPad Ultimate, once again throwing child data privacy into the spotlight. The LeapPad Ultimate is a rugged tablet made by LeapFrog that targets children with an array of education, game and eBook apps...

httpd: URL normalization inconsistency

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes '/', directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing wi...

SUSE-SU-2019:2046-1 Security update for ardana packages

This update for ardana package fixes the following issues: - Update to version 9.0+git.1560211997.7ac9792: Adds repository list parameter bsc1122825 - Update to version 9.0+git.1557219331.457b6e7: Update gerrit location SCRD-9140 - Switch to new Gerrit Server - Update to version...

CVE-2019-14521

The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter...

Valve: [steam client] Opening a specific steam:// url overwrites files at an arbitrary location

If a user opens steam://devkit-1/list-shortcuts?response=/tmp/testfile, a file /tmp/testfile will be created containing the response to this request. Another problem with this is that the file will be overwritten if it already exists. The owner of the file will be the same as the user that runs t...

CVE-2017-18383

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

CVE-2017-18383

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

Design/Logic Flaw

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

CVE-2017-18383

cPanel before 68.0.15 writes home-directory backups to an incorrect location SEC-309...

Google Chrome Security Bypass Vulnerability (CNVD-2019-26519)

Google Chrome is a web browser from Google, an American company. A security vulnerability exists in versions of Google Chrome prior to 76.0.3809.87, which stems from the program's failure to perform a check on the location of a click. An attacker could exploit the vulnerability by tricking a user...

CVE-2019-5401

A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields management URL, location, contact. But admin privileges are required to configure the...

Mobile Menace Monday: Dark Android Q rises

Android Q, the upcoming 10th major release of the Android mobile operating system, was developed by Google with three major themes in mind: innovation, security, and privacy. Today, we are going to focus mostly on security and privacy, although there are still many potential changes and updates o...

Streamlining Patch Management: Expert Advice

Patch management has been a song of constant sorrows for system administrator. There have been improvements. But still, 80 percent of enterprise systems feature unpatched CVE vulnerabilities, according CA Veracode’s State of Software Security. The good news is, software patching has gotten better...

The App Creeping on Your IG Location, Jakarta’s Insurance Crisis, and More News

Catch up on the most important news from today in two minutes or less...

On TikTok, Teens Meme Life360, the Safety App Ruining Their Summer

Parents can use Life360 to track their teen’s location in real time. The company can use that data to sell car insurance...

Bug in Anesthesia Respirators Allows Cyber-Tampering

A vulnerability in GE Healthcare’s Aestiva and Aespire anesthesia devices would allow an unauthenticated cybercriminal on the same network as the device to modify gas composition parameters within the devices’ respirator function, thus changing sensor readings for gas density. According to GE...

CVE-2019-1855

A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform a DLL preloading attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The...