FTC Releases Alert on Fake Apps for Mobile Devices

The Federal Trade Commission FTC has released an alert on fraudulent mobile apps designed to exploit consumers. Some fake apps may steal personal information such as credit card numbers. By taking precautions, users can protect themselves and their private data. US-CERT encourages users and...

Emlog personal blog system exists arbitrary file deletion vulnerability

Short for every memory log, emlog is a PHP and MySQL based blog and CMS builder. The /src/admin/data.php page of the emlog personal blog system has an arbitrary file deletion vulnerability. As Bak fails to bring in the unlink function directly after the restriction, allowing an attacker to delete...

Yahoo Admits 1 Billion Accounts Compromised in Newly Discovered Data Breach

In what believe to be the largest data breach in history, Yahoo is reporting a massive data breach that disclosed personal details associated with more than 1 Billion user accounts in August 2013. …And it's separate from the one disclosed by Yahoo! in September, in which hackers compromised as ma...

Multiple Stored XSS Vulnerabilities in Journalx 2.0, a Remote Processing System for Journal Manuscripts

Journalx 2.0 is an independently developed platform for remote processing of journal manuscripts developed by Beijing Magtech. Journalx 2.0 contains multiple stored XSS vulnerabilities. The vulnerabilities can be exploited by an attacker to submit data with js code on the personal information pag...

Wordpress Plugin Single Personal Message 1.0.3 SQL injection vulnerability

Author:sebaoknow Chong Yu 404 security lab Date:2016-12-06 1. Vulnerability description Simple Personal Message is for WordPress website dedicated to create the privacy and security of information systems. Using Ajax operation, may be based on a group of users between the station within the...

Wordpress Plugin Single Personal Message SQL Injection Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A SQL injection vulnerability exists in the message parameter of the admin.php page of the Wordpress plugin Sing...

Single Personal Message 1.0.3 – Authenticated SQL Injection

Type user access: any user. $GET‘message’ is not escaped. Is accessible for every registered user. http://www.example.com/wp-admin/admin.php?page=simple-personal-message-outbox&action=view&message=0%20UNION%20SELECT%201,2.3,name,5,slug,7,8,9,10,11,12%20FROM%20wpterms%20WHERE%20termid=1...

U.S. Dept Of Defense: Personal information disclosure on a DoD website

A Department of Defense website was mis-configured in a manner that could have exposed personal information. Thanks for notifying us of this, @spam404! IDOR exposing PII...

eFront 3.6.15: Steal your professors password

RIPS Analysis Our SAST tool RIPS analyzed the whole application in only 1m 32s and uncovered many severe security issues. Most of them are straight-forward SQL Injections that can be used to extract confidential user data, such as passwords, private messages, course results, and personal...

Bitmoji – Your Personal Emoji - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Bitmoji – Your Personal Emoji published at the 'play' market has multiple vulnerabilities...

Uber Portal Leaked Names, Phone Numbers, Email Addresses, Unique Identifiers

A series of vulnerabilities in UberCENTRAL, a portal Uber started during the summer to help businesses facilitate rides for customers, could have leaked the names, phone numbers, email addresses, and unique ID of all Uber users. Kevin Roh, a student who actively hunts for bugs in his spare time,...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was mis-configured in a manner that could have exposed personal account information. @tsug0d was as able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us! LDAP Injection...

3 Mobile UK Hacked – 6 Million Customers' Private Data at risk

Three, one of UK's biggest mobile operators, has become the latest victim of a massive data breach that reportedly left the personal information and contact details of 6 Million of its customers exposed. The company admitted the data breach late Thursday, saying that computer hackers gained acces...

VK.com: Stored XSS в личных сообщениях

Lack of data filtration, which leads to stored XSS in instant messenger service. Stored XSS in personal messages. The vulnerability exists due to the lack of filtering data which is taken from the META tags for demonstration preview of the site...

Over 1 Billion Mobile App Accounts can be Hijacked Remotely with this Simple Hack

Security researchers have discovered a way to target a huge number of Android and iOS apps that could allow them to remotely sign into any victim's mobile app account without any knowledge of the victim. A group of three researchers – Ronghai Yang, Wing Cheong Lau, and Tianyu Liu – from the Chine...

personalsavings.americanexpress.com XSS vulnerability

Vulnerable URL: https://personalsavings.americanexpress.com/application/app/nao?intlink=X"...

Android Banking Trojan Tricks Victims into Submitting Selfie Holding their ID Card

While some payment card companies like Mastercard have switched to selfies as an alternative to passwords when verifying IDs for online payments, hackers have already started taking advantage of this new security verification methods. Researchers have discovered a new Android banking Trojan that...

Android Lock Settings Service Privilege Gain Vulnerability

Android is an open source operating system based on Linux. Android's Lock Settings Service has a security vulnerability that allows remote attackers to gain access by removing a device's PIN or password...

OLX: Name, email, phone and more disclosure on user ID (API)

Hello, When I checked the OLX.pl app, I found out that when I click on a profile, personal information like email or phonenumber is exposed. GET https://ssl.olx.pl/api/v1/users/1/ HTTP/1.1 Host: ssl.olx.pl Cookie: PHPSESSID=hb6utlcj860nd7p2jt6ha0tu71 Connection: keep-alive Accept: / Version: v1.1...

Yahoo Reportedly to Confirm Breach of Hundreds of Millions of Credentials

Yahoo is expected to confirm a data breach that exposed hundreds of millions of credentials dating back four years. A report published today by Recode intimates that the total number of exposed credentials will be higher than the 200 million initially reported in early August. A request for comme...