August 22, 2017 – Morning Cyber Coffee Headlines – “Hamilton” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 22, 2017 - Headlines The Intelligence Community’s Top 3 Cybersecurity...

UBUNTU-CVE-2017-7890

The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c in the GD Graphics Library aka libgd, as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read 700 bytes from the top of the...

GraphicsMagick Denial of Service Vulnerability (CNVD-2017-19977)

GraphicsMagick is a simple set of image processing tools. The tool provides resizing, rotating, highlighting and other functions to images. A denial of service vulnerability exists in the 'WriteMAPImage' function in the coders/map.c file in GraphicsMagick version 1.3.26. An attacker can exploit...

Roombas will Spy on You

The company that sells the Roomba autonomous vacuum wants to sell the data about your home that it collects. Some questions: What happens if a Roomba user consents to the data collection and later sells his or her home -- especially furnished -- and now the buyers of the data have a map of a home...

mdah.ms.gov XSS vulnerability

Vulnerable URL: http://www.mdah.ms.gov/arrec/digitalarchives/maps/map.php?map=1"...

turnpikeinfo.com XSS vulnerability

Vulnerable URL: https://turnpikeinfo.com/maps-and-exits.php?roadname=pennsylvania-turnpike=1"...

Waze - GPS, Maps & Traffic - Certificates or keys found, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Waze - GPS, Maps & Traffic published at the 'play' market has multiple vulnerabilities...

maps-international.com XSS vulnerability

Open Bug Bounty ID: OBB-244933 Description| Value ---|--- Affected Website:| maps-international.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

What are Javascript Source Maps?

Its generally a good practice to minify and combine your assets Javascript & CSS when deploying to production. This process reduces the size of your assets and dramatically improves your websites load time. Source maps create a map from these compressed asset files back to the source files. This...

Google Map Store Locator by Matamko,4.0,SQL Injection

Google Map Store Locator by Matamko, 4.0, SQL Injection...

Location Map - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-026

This module enables you to display one simple location map via Google Maps. The module doesn't sufficiently sanitize user input in the configuration text fields of the module allows any tags and does not respect text format configuration. This vulnerability is mitigated by the fact that an attack...

mycollingwood.ca XSS vulnerability

Open Bug Bounty ID: OBB-203457 Description| Value ---|--- Affected Website:| mycollingwood.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HERE WeGo - Offline Maps & GPS - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application HERE WeGo - Offline Maps & GPS published at the 'play' market has multiple vulnerabilities...

Maps - Navigation & Transit - LGPL license, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Maps - Navigation & Transit published at the 'play' market has multiple vulnerabilities...

ip-geolocation-map-bing NSE Script

This script queries the Nmap registry for the GPS coordinates of targets stored by previous geolocation scripts and renders a Bing Map of markers representing the targets. The Bing Maps REST API has a limit of 100 markers, so if more coordinates are found, only the top 100 markers by number of IP...

Fedora Update for trytond-google-maps FEDORA-2016-d961441913

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MapmyIndia Maps & Directions - Base64 encoded String, Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application MapmyIndia Maps & Directions published at the 'play' market has multiple vulnerabilities...

Maps & Navigation — OsmAnd - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Maps & Navigation — OsmAnd published at the 'play' market has multiple vulnerabilities...

WordPress Google Maps Plugin Cross-Site Request Forgery Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on servers with PHP and MySQL.Google Maps is one of the map plug-ins. A cross-site request forgery vulnerability exists in the admin.jsp pag...

WordPress Google Maps 6.3.14 Cross Site Request Forgery Vulnerability

WordPress Google Maps plugin version 6.3.14 suffers from a cross site request forgery vulnerability. ------------------------------------------------------------------------ Persistent Cross-Site Scripting in WP Google Maps Plugin via CSRF...