Starbucks' iOS app storing user credentials in plain text

Watch out, coffee drinkers. If you are one of those 10 million Starbucks customers, who purchases drinks and food directly from their Smartphones, this news is for you! If you use Starbucks’ official iOS app, you should know that the company is not encrypting any of your information, including yo...

Apple Mac OS X 锁屏本地安全绕过漏洞(CVE-2013-5188)

BUGTRAQ ID: 63348 CVECAN ID: CVE-2013-5188 OS X（前称Mac OS X）是苹果公司为麦金塔电脑开发的专属操作系统的最新版本。 OS X 10.9之前版本在启用了hibernation及autologin后，从休眠状态转换时，无需输入锁屏密码，这可使物理位置接近的攻击者在浏览了休眠状态的工作站后，获取非法访问权限。 0 Apple Mac OS X 10.9 厂商补丁： Apple ----- Apple已经为此发布了一个安全公告（msg00004）以及相应补丁: msg00004：APPLE-SA-2013-10-22-3 OS X...

Major Companies Fall Victim to Social Engineering

The annual Social Engineering Capture the Flag contest held during DEF CON may seem on the surface to be just an opportunity for pen-testers and hackers to flex their pretexting muscles. But if you’re one of the 10 major technology, manufacturing and critical infrastructure organizations targeted...

Microsoft Windows USB Descriptor CVE-2013-3200 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that is related to the DirectX Graphics Kernel Subsystem. An attacker with physical access can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the...

Apple iOS v7.0.2 5S - Denial of Service Vulnerability (PoC)

Document Title: =============== Apple iOS v7.0.2 5S - Denial of Service Vulnerability PoC References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1106 Video: https://www.youtube.com/watch?v=jf4t0yFoSD8 Release Date: ============= 2013-10-02 Vulnerability Laboratory ID VL-ID:...

Amazon Linux AMI : kernel (ALAS-2012-142)

A use-after-free flaw was found in the Linux kernel's memory management subsystem in the way quota handling for huge pages was performed. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. CVE-2012-2133 , Moderate A use-after-fr...

Telecom Italia Cookie Handling vulnerability allows hackers to hijack email accounts

A cookie is a piece of data that is issued by a server in an HTTP response and stored for future use by the HTTP client. Quite simply, a cookie is a small text file that is stored by a browser on the user’s machine. Cookies are plain text; they contain no executable code. The client then...

Windows 7 SP1 Local Access SYSTEM Compromise

Discovered by: Anastasios Monachos secuid0 - anastasiosmatgmaildotcom Vendor: Microsoft Affected Software: Windows 7 SP1 and probably other Title: Owning Windows 7 - From Recovery to "nt authority\system" - Physical Access Required See also:...

BlackBerry Z10 Privilege Escalation Security Vulnerability

BlackBerry has released a security update resolving an escalation of privilege vulnerability that existed in “BlackBerry Protect” enabled devices running version 10.0.10.261 and earlier operating systems. The company says that version 10.0.9.2743 is not affected and that they have found no eviden...

BlackBerry Warns of Z10, PlayBook Security Vulnerabilities

BlackBerry’s security incident response team has issued two advisories warning Z10 smartphone and PlayBook tablet users to upgrade to the latest version of the operating system and software on both platforms. The patches address a remote code-execution vulnerability in the Adobe Flash Player...

Xpient - Cash Drawer Operation

Xpient - Cash Drawer Operation Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Xpient Cash Drawer Operation Vulnerability 1. Advisory Information Title: Xpient Cash Drawer Operation Vulnerability Advisory ID: CORE-2013-0517 Advisory URL:...

[USN-1803-1] X.Org X server vulnerability

========================================================================== Ubuntu Security Notice USN-1803-1 April 17, 2013 xorg-server, xorg-server-lts-quantal vulnerability ========================================================================== A security issue affects these releases of Ubun...

Ubuntu: Security Advisory (USN-1803-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : xorg-server, xorg-server-lts-quantal vulnerability (USN-1803-1)

It was discovered that the X.Org X server did not properly clear input events in certain circumstances. A local attacker with physical access could use this flaw to capture keystrokes. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu securi...

USN-1803-1: X.Org X server vulnerability

It was discovered that the X.Org X server did not properly clear input events in certain circumstances. A local attacker with physical access could use this flaw to capture keystrokes...

Microsoft: Uninstall Faulty Patch Tuesday Security Update

Microsoft announced last night that it has stopped pushing a security update originally released on Patch Tuesday because the fix is causing some PCs to blue screen. Microsoft recommends users uninstall the patch, which is also causing compatibility with some endpoint security software. “We’ve...

CVE-2011-4515

Siemens WinCC TIA Portal 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging 1 physical access or 2 Sm@rt Server access...

Design/Logic Flaw

Siemens WinCC TIA Portal 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging 1 physical access or 2 Sm@rt Server access...

CVE-2011-4515

Siemens WinCC TIA Portal 11 uses a reversible algorithm for storing HMI web-application passwords in world-readable and world-writable files, which allows local users to obtain sensitive information by leveraging 1 physical access or 2 Sm@rt Server access...

Microsoft flaw allows USB loaded with payload to bypass security controls

During March Patch Tuesday of 2013, Microsoft released seven new security bulletins, with four rated as critical, and others as Important. Most interesting one was MS13-027, which is rated as "important" because the attack requires physical access to the vulnerable machine. This flaw allows anyon...