Code injection

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538...

CVE-2017-1352

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538...

CVE-2017-1352

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538...

PT-2017-12985

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.5 through 7.6 Description The issue allows an authenticated user to inject commands into work orders. These commands could be executed by another user who downloads the affected file. Recommendations For...

CVE-2017-1352: Improper Neutralization of Special Elements used in a Command

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to inject commands into work orders that could be executed by another user that downloads the affected file. IBM X-Force ID: 126538...

Heilongjiang Industrial Cloud Service Android APP has overstepping access vulnerability

Heilongjiang Industrial Cloud Service app is an office communication platform. Heilongjiang Industrial Cloud Service Android APP has an override access vulnerability. An attacker can utilize the vulnerability to arbitrarily view other users' order product information...

CVE-2017-1357

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684...

CVE-2017-1357

IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. IBM X-Force ID: 126684...

PT-2017-12990

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management versions 7.5 through 7.6 Description The issue allows an authenticated user to manipulate work orders, potentially leading to forged emails that could be used in further advanced attacks. Recommendations For IBM...

Boozt Fashion AB: [www.boozt.com] - Authentication bypass

Description I have found a flaw in the authentication process when accessing the website by visiting an unsubscribe link. PoC 1. Visit http://click.email.boozt.com/?qs=723df61c937e4dbf9e378d2157f7907baa95fa00699f2b4d13e192b1d14ed67323d5c7a75c6f801baf1e68c2beabbc43d574caeb9b6f8c085971631d636b3cda ...

Hunan Ding Ding Easily Builds App with Multiple Vulnerabilities

Hunan Ding Ding Easily Build APP is an order-taking tool for engineers. Hunan Ding Ding Easy Build APP has arbitrary user registration, payment flaws and arbitrary password reset vulnerability. Attackers can use the vulnerability to register any cell phone number, modify any user order informatio...

Privacy Activists Suffer Legal Setback In National Security Letter Case

Privacy activists suffered a legal blow when a panel of California appeals court judges ruled Monday the Federal Bureau of Investigation could continue its practice of secretly issuing National Security Letter NSL requests for customer data from communications firms. The case involved a challenge...

Snapchat: [spectacles.com] Bypassing quantity limit in orders

Hi Snapchat team, In the https://www.spectacles.com the quantity of orders has limited for spectacles is 6 and for accessories is 10 according to help support page. But it can easily be manipulated by editing the URL. Problem originates from limiting the quantity of the items is with just the UI...

wsionline.com XSS vulnerability

Vulnerable URL: http://www.wsionline.com/uniformorders/REPORTMANAGERORDERS.ASP?operation=DELETEORDERNUM=1"...

The Dangers of Secret Law

Last week, the Department of Justice released 18 new FISC opinions related to Section 702 as part of an EFF FOIA lawsuit. Of course, they don't mention EFF or the lawsuit. They make it sound as if it was their idea. There's probably a lot in these opinions. In one Kafkaesque ruling, a defendant w...

EFF Sues DOJ Over National Security Letter Disclosure Rules

The Electronic Frontier Foundation sued the United States Department of Justice Wednesday demanding to know whether the agency is complying with rules that mandate a periodic review of National Security Letter gag orders. The suit, filed in U.S. District Court for the Northern District of...

Sunshine Car Life APP has information leakage vulnerability

Sunshine Car Life APP is a one-stop car owner service platform designed to provide you with authoritative national violation query, car insurance price calculation, trip management, claims service, and so on. There is an information leakage vulnerability in Sunshine Car Life APP, because the logi...

Apple Receives First National Security Letter

Apple revealed this week that it received a National Security Letter during the last six months of 2016. The news, which came as part of the company’s latest biannual transparency report, marks the first NSL Apple has reported receiving. The iPhone manufacturer released the report via a portal on...

Google Chrome < 58.0.3029.96 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 58.0.3029.96. It is, therefore, affected by a vulnerability as referenced in the 201705stable-channel-update-for-desktop advisory. - Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Ma...

Shopify: Stored XSS in [shop].myshopify.com/admin/orders/[id]

Hi, I have found a stored XSS vulnerability in shop.myshopify.com/admin/orders/id in conversion details links, it's the same as 55842 but this one is through landing page URL not the referrer. Steps to reproduce: 1. Navigate to shop.myshopify.com/ 2. Modify landingpage cookie value to...