God Kings 0.60.1 Notification Spoofing

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: God Kings Vendor URL: https://play.google.com/store/apps/details?id=com.innogames.gkandroid Type: Improper Verification of Intent by Broadcast Receiver CWE-925 Date found: 2020-09-07 Date...

Chrome 86 Aims to Bar Abusive Notification Content

Google has added a new feature to Chrome 86 that aims to stomp out abusive notification content. Web notifications are utilized for a variety of applications – such as prompting site visitors to sign up for newsletters. However, they can also be misused for phishing, malware or fake messages that...

DRIVE.NET, Inc.: [www.drive2.ru] Insufficient Security Configurability - Notification message not sent when account is deleted

Email notifications are not sent when account is deleted. Email notifications are not sent when account is deleted. Best Practices As recommended practices, For security reasons, users should be able to be notified via email notification of changes to important operations such as account deletion...

Imperva’s Mobile Security App

How many apps do you currently have on your mobile device? Is this number a total across both your personal and professional devices? Did you know that between Android’s Google Play Store and Apple’s App Store, there are between 2.2 and 2.8 million apps available to download? Did you know that,...

CVE-2020-24722

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause...

CVE-2020-24722

The CVE-2020-24722 issue affects GAEN (Google/Apple Exposure Notifications) protocol used by COVID-19 apps on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack, which can lead to metadata deanonymization and risk...

ASB-A-156020795

In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2020-24721

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the...

CVE-2020-24721

The CVE-2020-24721 entry refers to the GAEN (Google/Apple Exposure Notifications) protocol used in Android/iOS COVID-19 apps. The issue is described as coercion of a user into proving or disproving an exposure notification due to the persistent state of a private framework. Connected sources (NVD...

CVE-2020-24721

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-09-29, as used in COVID-19 applications on Android and iOS. It allows a user to be put in a position where he or she can be coerced into proving or disproving an exposure notification, because of the...

Corona Exposure Notifications API Data Leakage

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Corona Exposure Notifications API for Apple iOS and Google Android risk of coercion/data leakage post notification CVE-2020-24721 / CVSS v3.1 score: 5.9 AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:H/RL:U/RC:C/CR:H/IR:L...

RHEL 8 : CloudForms 5.0.8 (RHSA-2020:4134)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:4134 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments...

jobschampions.co.uk Cross Site Scripting vulnerability OBB-1373425

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

NERVE - Network Exploitation, Reconnaissance & Vulnerability Engine

NERVE is a vulnerability scanner tailored to find low-hanging fruit level vulnerabilities, in specific application configurations, network services, and unpatched services. It is not a replacement for Qualys, Nessus, or OpenVAS. It does not do authenticated scans, and operates in black-box mode...

CVE-2020-25735

webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/addannouncement.php, administration/departments.php, administration/locations.php, expenses/claimtype.php, projects/editproject.php, and general/newnotifications.php...

CVE-2020-25735

WebTareas v2.1 and earlier versions are affected by cross-site scripting (XSS) in multiple PHP endpoints: clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editp...

CVE-2020-0425

There is a possible way to view notifications even when the "Lockdown" feature is on. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124000380...

CVE-2020-0425

There is a possible way to view notifications even when the "Lockdown" feature is on. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124000380...

CVE-2020-0425

There is a possible way to view notifications even when the "Lockdown" feature is on. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124000380...

GitLab: Adding everyone to the repo due to the lack of rate limit

Summary Since there is no rate limit in the inviting users to the repository section, it is possible to add all users on gitlab to a repository. Steps to reproduce Step-by-step guide to reproduce the issue, including: 1. Create a repository 2. go to the project members section 3. choose a random...