BBC: MiSafes’ child-tracking smartwatches are ‘easy to hack’

Following our research on the MiSafes kids tracking watch we spoke to the BBC's Rory Cellan-Jones and Leo Kelion about the risks, and what consumers can do. We found that the devices didn't encrypt user data, and that each child's account wasn't secured. The result is that children's movements...

Information leakage vulnerability in the "personal data" section of the Palm Parent App

Palm Good Parent App is an educational software for parents. An information leakage vulnerability exists in the "Personal Information" section of Palm Parent App. Attackers can obtain information about other users by tampering with packets...

GHSA-83R3-C79W-F6WC High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations...

PT-2018-12638 · Powerdns +3 · Powerdns Recursor +3

Name of the Vulnerable Software and Affected Versions: PowerDNS Recursor versions 4.0.0 through 4.1.4 Description: A remote attacker can send a DNS query for a meta-type like OPT, leading to a zone being wrongly cached as failing DNSSEC validation. This issue arises when the parent zone is signed...

Microstrategy Web Directory Traversal Vulnerability

MicroStrategy Web is a highly interactive, easy-to-use application for report analysis and continuous business monitoring. A directory traversal vulnerability exists in Microstrategy Web 7 at "/WebMstr7/servlet/mstrWeb". A remote authenticated user can exploit this vulnerability to bypass expecte...

USN-3784-1 AppArmor update

As a security improvement, this update adjusts the private-files abstraction to disallow writing to thumbnailer configuration files. Additionally adjust the private-files, private-files-strict and user-files abstractions to disallow writes on parent directories of sensitive files...

CVE-2018-17254

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter...

CVE-2018-17254

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter...

Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

Bootstrap cross-site scripting vulnerability (CNVD-2018-13372)

Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript . A cross-site scripting vulnerability exists in the collapse data-parent attribute in Bootstrap versions prior to 4.1.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

CVE-2018-14040

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

AZL-43750 CVE-2018-14040 affecting package python-openstackdocstheme 1.29.0-8

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

CVE-2018-14040

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

AZL-44334 CVE-2018-14040 affecting package python-openstackdocstheme 3.0.0-9

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

AZL-13232 CVE-2018-14040 affecting package reaper for versions less than 3.1.1-1

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

UBUNTU-CVE-2018-14040

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

PT-2018-12295 · Twitter +4 · Bootstrap +4

Name of the Vulnerable Software and Affected Versions: Bootstrap versions 2.3.0 through 3.4.0 Bootstrap versions 4.0.0 through 4.1.1 Description: The issue allows for XSS in the collapse data-parent attribute. Recommendations: For Bootstrap versions 2.3.0 through 3.4.0, update to version 3.4.0 or...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In Bootstrap, XSS is possible in the collapse data-parent attribute...

Serverwg Directory Traversal Vulnerability

serverwg is an http server. A directory traversal vulnerability exists in serverwg. An attacker can exploit this vulnerability to gain access to the file system by placing a '... /' sequence in a URL to gain access to the file system...