Instacart: Authorization Bypass in Delivery Chat Logs

An authorization issue in the mobile app API allows any Instacart user to gain access to other users' order delivery chat logs. The /api/v2/orderdeliveries/:orderdeliveryid/orderchangelogs endpoint does not sufficiently check if the user has permissions to access that particular order's chat logs...

Threat Outbreak Alert RuleID23345: Email Messages Distributing Malicious Software on June 8, 2016

Medium Alert ID: 46610 First Published: 2016 June 8 12:39 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23345 may contain the following files: Name | Size...

CVE-2016-3072

Multiple SQL injection vulnerabilities in the scopedsearch function in app/controllers/katello/api/v2/apicontroller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the 1 sortby or 2 sortorder parameter...

Threat Outbreak Alert RuleID23087: Email Messages Distributing Malicious Software on May 31, 2016

Medium Alert ID: 46461 First Published: 2016 May 31 14:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23087 may contain the following files: Name | Size...

Zomato: Bypass OTP verification when placing Order

User can bypass the OTP verification needed while placing an order with a restaurant. User can give a random number and intercept the OTP request. If wrong OTP is provided then the error message shows the session code which is the OTP in this case. Hence that session code can be used to verify th...

Apple hires Encryption Expert to Beef Up Security on its Devices

The FBI and other law enforcement agencies have waged legal war on encryption and privacy technologies. You may have heard many news stories about the legal battle between Apple and the FBI over unlocking an iPhone that belonged to the San Bernardino shooter. However, that was just one battle in ...

Threat Outbreak Alert RuleID23044: Email Messages Distributing Malicious Software on May 25, 2016

Medium Alert ID: 46351 First Published: 2016 May 24 13:45 GMT Last Updated: 2016 May 25 21:25 GMT Version: 2 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23044 and...

Threat Outbreak Alert RuleID22976: Email Messages Distributing Malicious Software on May 19, 2016

Medium Alert ID: 46291 First Published: 2016 May 19 13:44 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22976 may contain the following files: Name | Size...

Red Hat Satellite SQL Injection Vulnerability

Red Hat Satellite is a suite of system management platforms from Red Hat, Inc. that can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in the 'sortby' and 'sortorder' parameters...

Katello: Authenticated sql injection via sort_by and sort_order request parameter

An input sanitization flaw was found in the scoped search parameters sortby and sortorder in the REST API. An authenticated user could use this flaw to perform an SQL injection attack on the Katello back end database...

Tiny Tiny RSS SQL Injection Vulnerability

A blind injection vulnerability exists in $itemid in Tiny Tiny RSS processcategoryorder. An attacker is able to connect to the library database and execute database statements...

LebiShop Mall Log Unauthorized Access Vulnerability

LebiShop mall system is an online mall system using ASP.NET language. The system is widely used in small and medium-sized e-commerce enterprises. The payment-related log information of this mall system is stored in the Web directory and uses date commands, and the log files leak sensitive...

Child Porn Suspect Held in Jail for 7 Months for refusing to Decrypt Hard Drives

In Brief A suspect of child pornography possession, Francis Rawls, who is a former Philadelphia Police Department sergeant, has been in solitary confinement without charges for last seven months and will remain until he complies with a court order forcing him to decrypt his password-protected har...

modified eCommerce SQL Injection Vulnerability

modified eCommerce is an open source store software. Modified eCommerce suffers from a SQL injection vulnerability due to the easybillcsv.php file failing to adequately filter the 'ordersstatus' and 'customersstatus ' GET parameters, allowing remote attackers to submit specially crafted SQL queri...

Magento Enterprise Edition and Magento Community Edition Information Disclosure Vulnerability

Magento is a professional open source PHP e-commerce system of the United States Magento company.Magento Enterprise Edition EE is an enterprise version.Magento Community Edition CE is a community edition. Magento EE 1.14.2.3 before the version and Magento CE 1.9.2.3 before the version of the...

CVE-2016-2212

The getOrderByStatusUrlKey function in the MageRssHelperOrder class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the orderid in a JSON object ...

CVE-2016-2212

The getOrderByStatusUrlKey function in the MageRssHelperOrder class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the orderid in a JSON object ...

CVE-2016-2212

The getOrderByStatusUrlKey function in the MageRssHelperOrder class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the orderid in a JSON object ...

Encryption Bill: Bad for Privacy, Security and Business

A bill that would force companies to decrypt messages and unlock devices if ordered to do so by government court order, surfaced Friday and is rattling security and privacy advocates and IT business leaders. They contend the bill is misguided and will have a detrimental effect on civil liberties...

Magento RSS Feed Information Disclosure Vulnerability

Magento Web E-Commerce Platform is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...