Service worker meeting notes

On July 28th-29th we met up in the Mozilla offices in Toronto to discuss the core service worker spec. I'll try and cover the headlines here. Before I get stuck in to the meaty bits of the meeting, our intent here is to do what's best for developers and the future of the web, so if you disagree...

Facebook Messenger End-to-End Encryption Not On By Default

Facebook today began a test program rolling out opt-in end-to-end encryption for its Messenger service called Secret Conversations. The end-to-end encryption is based on the Signal protocol developed by Open Whisper Systems, the same protocol that stands up the crypto in the Signal and WhatsApp...

WordPress Plugin Double Opt-In for Download 2.0.9 - SQL Injection

Exploit Title: Double Opt-In for Download 2.0.9 Sql Injection Date: 06-06-2016 Software Link: https://wordpress.org/plugins/double-opt-in-for-download/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description...

WordPress Double Opt-In for Download Plugin 2.0.9 - SQL Injection

This WordPress Double Opt-In for Download plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Plugin Double Opt-In for Download 2.0.9 - SQL Injection

WordPress Plugin Double Opt-In for Download 2.0.9 - SQL Injection Exploit Title: Double Opt-In for Download 2.0.9 Sql Injection Date: 06-06-2016 Software Link: https://wordpress.org/plugins/double-opt-in-for-download/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

WordPress Double Opt-In For Download 2.0.9 SQL Injection

Exploit Title: Double Opt-In for Download 2.0.9 Sql Injection Date: 06-06-2016 Software Link: https://wordpress.org/plugins/double-opt-in-for-download/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description...

Facebook Messenger App — Choose either End-to-End Encryption or Artificial Intelligence

Facebook is set to introduce end-to-end encryption for its Messenger app, allowing more than its 900 Million users to send and receive messages that can not be read or intercepted by law enforcement or even the social network itself. However, it’s not the kind of end-to-end encrypted chat feature...

Facebook Ads now Tracks you, Even if you don't have an Account

There's nowhere to hide across the web, especially from the marketing and advertising companies. If you are paranoid about your privacy, you may get upset to know that Facebook will now track and deliver targeted Ads on other apps and websites for everyone, even if you do not have Facebook...

youronlinechoices.com XSS vulnerability

Vulnerable URL: http://www.youronlinechoices.com/optoutinterfacev2?lang=at'alert/XSSPOSED/...

ISC BIND 9.3.0 < 9.9.8-P3 / 9.9.x-Sx < 9.9.8-S4 / 9.10.x < 9.10.3-P3 Multiple DoS

According to its self-reported version number, the installation of ISC BIND running on the remote name server is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to improper handling of certain string formatting options. An authenticated,...

WordPress Double-Opt-in-for-Download插件SQL注入漏洞

No description provided by source...

Windows 10 Upgrade Become More Creepy, No Option to Opt-Out

If you are running Windows 7 or Windows 8.1 and have no plans to switch to Windows 10, then Microsoft could force you to install Windows 10, making it harder for you to cancel or opt-out of upgrading. Note: Above image has been photoshopped, but the original screenshot taken by Windows users is...

HTTPS Available as Opt-In for Blogspot

Google said on Wednesday it has made HTTPS available as an opt-in for its Blogspot publishing service. Google and other technology providers have been ramping up encryption rollouts in the two years since the publication of the Snowden documents began. To date, Google has encrypted Gmail, search,...

WordPress G-Lock Double Opt-in Manager Plugin - Multiple Vulnerabilities

This plugin is prone to security bypass vulnerabilities. Solution Update the plugin...

Verizon Allows Opt Out of UIDH Mobile Supercookie

Verizon Wireless has made a change that now allows customers to opt out of the ad-targeting program that relies on the so-called supercookie identifier that was inserted into Web requests users send. The use of the identifier, known as a UIDH, drew the ire of privacy advocates and users when it w...

Twitter will now Track EVERY App You have Installed on Your Smartphone

Like Facebook and Google, Twitter will soon be collecting your smartphone data in order to provide a "more personal Twitter experience" by serving targeted advertisements. The popular microblogging service Twitter said Wednesday that it will start collecting information about the other applicatio...

Verizon to Pay Largest Ever Consumer Privacy Settlement

Verizon will pay the Federal Communications Commission $7.4 million as part of a settlement over the company’s failure to adequately inform and obtain consent from customers before using their personal information to develop thousands of tailored marketing campaigns. Officials say this fine...

Scratcher (SQL/XSS) Multiple Remote Vulnerability

No description provided by source. + Scratcher SQL/XSS Multiple Remote Vulnerability 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ 0 0 \ \ /\ /\ \ \ \ /\ \ \ /...

CSO Lanifex Outreach Project Tool 0.946 b Request Origin Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6630/info It has been reported that OPT accepts the values supplied supplied by users in HTTP headers as the originating IP address of a request. It is possible for a remote host to supply a fake IP address in one of thes...

Gallo 0.1.0 - Remote File Include Vulnerability

No description provided by source. 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'\ \ /\ \ \ \ /'\ 0 0 \ \ /\ /\ \ \ \ /\ \ \ /\ /\ \ \ \ \ \ \ / 1 1 \ \ \ \\ \ \ /\ \...