Verizon Rebuts Critics of Data-Collecting App

Verizon broke its silence today on what many believed would be a controversial rollout of an app made by Evie Labs called AppFlash, that had been identified by privacy advocates as spyware. The wireless carrier and broadband ISP defended itself Friday saying its critics were flat-out wrong. Veriz...

Pornhub: youporn email notification enable/disable and newsletter

Researcher discovered a CSRF affecting email notification and newsletter opt-in settings. Triaged as an exception, not eligible for bounty/reward...

wordpress plugin Germany-likes-opt-in-facebook cross-site scripting vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The wordpress plugin Germany-likes-opt-in-facebook suffers from an xss vulnerability due to improper filtering of user input,...

DEBIAN-CVE-2016-9798

In BlueZ 5.42, a use-after-free was identified in "confopt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash...

UBUNTU-CVE-2016-9798

In BlueZ 5.42, a use-after-free was identified in "confopt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash...

'Web Of Trust' Browser Add-On Caught Selling Users' Data — Uninstall It Now

Browser extensions have become a standard part of the most popular browsers and essential part of our lives for surfing the Internet. But not all extensions can be trusted. One such innocent looking browser add-on has been caught collecting browsing history of millions of users and selling them t...

PT-2016-7826

Name of the Vulnerable Software and Affected Versions BlueZ version 5.42 Description A use-after-free issue was identified in the conf opt function in the tools/parser/l2cap.c source file. This issue can be triggered by processing a corrupted dump file, resulting in an hcidump crash...

Wordpress plugin double-opt-in-for-download has multiple cross-site scripting vulnerabilities

double-opt-in-for-download is a Wordpress plugin that is used to capture the name and email address of visitors by offering a free download to the user's visitors in exchange for their email address with the Double Opt-In plugin! Wordpress plugin double-opt-in-for-download has an xss vulnerabilit...

Design/Logic Flaw

ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service assertion failure and daemon exit via malformed options data in an OPT resource record...

DEBIAN-CVE-2016-2848

ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service assertion failure and daemon exit via malformed options data in an OPT resource record...

CVE-2016-2848

ISC BIND vulnerability CVE-2016-2848 affects BIND 9.1.0–9.8.4-P2 and 9.9.0–9.9.2-P2, allowing remote attackers to cause a denial of service (assertion failure and daemon exit) by sending malformed options data in an OPT resource record. Exploitation is via specially crafted DNS packets; impact is...

CVE-2016-2848

ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service assertion failure and daemon exit via malformed options data in an OPT resource record...

CVE-2016-2848: Improper Input Validation

ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service assertion failure and daemon exit via malformed options data in an OPT resource record...

PT-2016-5237

Name of the Vulnerable Software and Affected Versions ISC BIND versions 9.1.0 through 9.8.4-P2 ISC BIND versions 9.9.0 through 9.9.2-P2 Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon exit, by sending a specially crafted DNS...

CVE-2016-5662: Undefined Security Weakness

Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors...

PT-2016-6620

Name of the Vulnerable Software and Affected Versions Accellion Kiteworks appliances versions prior to kw2016.03.00 Description The issue allows local users to gain privileges via unspecified vectors due to the use of setuid-root permissions for /opt/bin/cli. Recommendations For versions prior to...

WhatsApp to Share Your Data with Facebook — You have 30 Days to Stop It

Nothing comes for Free, as "Free" is just a relative term used by companies to develop a strong user base and then use it for their own benefits. The same has been done by the secure messaging app WhatsApp, which has now made it crystal clear that the popular messaging service will begin sharing...

Service worker meeting notes

On July 28th-29th we met up in the Mozilla offices in Toronto to discuss the core service worker spec. I'll try and cover the headlines here. Before I get stuck in to the meaty bits of the meeting, our intent here is to do what's best for developers and the future of the web, so if you disagree...

Facebook Messenger End-to-End Encryption Not On By Default

Facebook today began a test program rolling out opt-in end-to-end encryption for its Messenger service called Secret Conversations. The end-to-end encryption is based on the Signal protocol developed by Open Whisper Systems, the same protocol that stands up the crypto in the Signal and WhatsApp...

WordPress Double Opt-In For Download 2.0.9 SQL Injection

Exploit Title: Double Opt-In for Download 2.0.9 Sql Injection Date: 06-06-2016 Software Link: https://wordpress.org/plugins/double-opt-in-for-download/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description...