Cross-origin restriction bypass using Fetch — Mozilla

Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue...

openstack-tripleo-heat-templates: unsafe pipeline ordering of swift staticweb middleware

A flaw was discovered in the pipeline ordering of OpenStack Object Storage's staticweb middleware in the swiftproxy configuration generated from the openstack-tripleo-heat-templates package OpenStack director. The staticweb middleware was incorrectly configured before the Identity Service, and...

Ashley Madison Hackers (with another 300GB Dump) – Wait, Cheaters! We haven't Yet Done

Over a month ago, a group of hackers breached the popular cheater's dating service Ashley Madison and its parent company Avid Life Media, affecting tens of Millions site customers private life and also dump the website's source code onto the dark web. The hackers behind the Ashley Madison hack, w...

Microsoft XML Core Services Information Disclosure Vulnerability

Microsoft XML Core Services MSXML is the United States Microsoft Microsoft company's set of services including SDK software development kit, which is mainly used for the implementation or development of applications designed by XML. An information disclosure vulnerability exists in Microsoft XML...

CVE-2015-2711

Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a UR...

UBUNTU-CVE-2015-2711

Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a UR...

SAP NetWeaver Java AS WD_CHAT - Information disclosure vulnerability

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.1 – 7.5 Vendor URL: SAP Bugs: Information disclosure Reported: 04.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 08.03.2016 Reference: SAP Security Note 2255990 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION...

CVE-2012-5505

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...

Cross site request forgery (csrf)

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...

PYSEC-2014-47

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...

CVE-2012-5505

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...

Sucuri: Usage of HTTP for exporting graph data as images

Whenever a user of waf.sucuri.net exports his reports graph data as a png, an unencrypted request is sent over to export.highcharts.com. This enables a mitm-able attacker to sniff and|or replace exported image. Also, the whole practice of offloading potentially private user data to an unrelated...

iOS TIOD 1.3.3 - Directory Traversal

No description provided by source. Exploit Title: TIOD v1.3.3 for iPhone / iPod touch, Directory Traversal Date: 03/03/2011 Author: R3d@l3rt, H@ckk3y E-Mail : R3dal3rt.team at gmail dot com Twitter : http://twitter.com/R3dAl3rtTeam Software Link:...

Palm OS 3.5.2 Weak Encryption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1715/info Palm OS is shipped with a security feature which enables a user to set password protection on various applications.The HotSync process allows a user to connect to a machine on the network through their Palm...

openSUSE Security Update : opera (openSUSE-SU-2012:1702-1)

Update to 12.12 - Fixes and Stability Enhancements - New option 'Delete settings and data for all extensions' option off by default in the Delete Private Data dialog - Corrected an issue where using the 'Delete Private Data' dialog could delete extension and settings data - Redesigned the 'Delete...

statTypes REST API exposes all statistics field names anonymously

On an instance with no anonymous access enabled, /rest/gadget/1.0/statTypes returns a list of all stattable custom fields names and IDs in the instance in response to anonymous requests. This is a nasty exposure of data - admins have no way of knowing that private data shouldn't be put into custo...

Ubuntu 14.04 LTS : Django vulnerabilities (USN-2212-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2212-1 advisory. Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby discovered that Django improperly removed Vary and Cache-Control headers from HTTP responses when...

NSA denies Report that Agency knew and exploited Heartbleed Vulnerability

The Bloomberg claimed that the U.S. National Security Agency NSA knew about the most critical Heartbleed flaw and has been using it on a regular basis to gather “critical intelligence” and sensitive information for at least past two years and decided to keep the bug secret, citing two sources...

Amazon 1Button App for Chrome, Firefox Leaks Private Data

Amazon 1Button, a browser add-on that provides users with easy access to the Amazon online marketplace, is leaking private information like a sieve, according to a security researcher. Krzysztof Kotowicz, a researcher specializing in Web security, said the app reports every URL to visit to...

Hacking PayPal accounts to steal user Private data

If you're making a lot of money and you want to keep records of your transactions, then using PayPal's Reporting system you can effectively measure and manage your business. Nir Goldshlager, founder of Breaksec and Security Researcher reported critical flaws in Paypal Reporting system that allowe...