A Second Life for the 'Do Not Track' Setting—With Teeth

In recent years, the setting has been criticized as being essentially meaningless. But it might have a crucial role to play in enforcing privacy regulations...

Slack: URL filter bypass in Enterprise Grid

URL filter bypass in Enterprise Grid Description Slack Enterprise Grid seems to be able to add arbitrary column to the profile of the account. In my company there is a おすすめランチ My Favorite Lunch column, and we can set the URL of the website and Display text. F429131 F429132 Only the http: or https...

How to Stop Facebook App From Tracking Your Location In the Background

Every app installed on your smartphone with permission to access location service "can" continually collect your real-time location secretly, even in the background when you do not use them. Do you know? — Installing the Facebook app on your Android and iOS smartphones automatically gives the...

CVE-2019-7729

The CVE affects the Bosch Smart Camera App for Android prior to version 1.3.1. It arises from insecure permission settings, enabling a local attacker to retrieve video clips or still images cached for clip sharing. Impact is limited to confidentiality (partial), with no egregious integrity/availa...

Android Users: Check This Facebook Location Privacy Setting ASAP

Android users can now stop Facebook from tracking their location when they aren't using the Facebook app...

CVE-2019-8910

An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=sitepost CSRF...

CVE-2018-20232

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the rendering of retrieved content from a url location that could be...

Yokogawa Powercert PC parameter setting tool Detection (Windows SMB Login)

Detects the installed version of Yokogawa Powercert PC parameter setting tool for Windows. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

WordPress WP User Manager 2.0.8 Shell Upload

Exploit Title: Wordpress Plugin WP User Manager 2.0.8 - Arbitrary file upload Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 5, 2019 Vendor Homepage: https://wpusermanager.com Software Link : https://wordpress.org/plugins/wp-user-manager/ Tested...

State of the Internet, Volume 5, Issue 1

Is it too late to still say "Happy New Year?" We don't think so. We're kicking off 2019 with our first issue of the State of the Internet / Security. Goal setting is something that security teams around the world are doing right now. What are your team's goals? How do your goals align with the...

CVE-2019-6799

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP...

CVE-2019-6799

An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfile PHP...

CVE-2018-1000411

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result...

CVE-2018-5738 Some versions of BIND can improperly permit recursive query service to unauthorized clients

Change 4777 introduced in October 2017 introduced an unforeseen issue in releases which were issued after that date, affecting which clients are permitted to make recursive queries to a BIND nameserver. The intended and documented behavior is that if an operator has not specified a value for the...

Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation

Microsoft Windows 10 - XmlDocument Insecure Sharing Privilege Escalation Windows: XmlDocument Insecure Sharing Elevation of Privilege Platform: Windows 10 1809 almost certainly earlier versions as well. Class: Elevation of Privilege Security Boundary per Windows Security Service Criteria:...

Joomla! cross-site scripting vulnerability (CNVD-2019-14555)

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in the Global Configuration textfilte...

CVE-2018-1000411

A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test result...

Fedora 28 : 1:epiphany (2018-a5e45fc9f7)

Fix CVE-2018-11396/CVE-2018-12016 795740 - Allow Ctrl+T in app mode again due to unintended consequences 796204 - Don't remember passwords when the setting is disabled 796219 - Fix password manager crash on chase.com GitLab 11 Note that Tenable Network Security has extracted the preceding...

Design/Logic Flaw

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...

CVE-2018-18959

An issue was discovered on Epson WorkForce WF-2861 10.48 LQ22I3, 10.51.LQ20I6 and 10.52.LQ17IA devices. On the 'Air Print Setting' web page, if the data for 'Bonjour Service Location' at /PRESENTATION/BONJOUR is more than 251 bytes when sending data for Air Print Setting, then the device no longe...