IBM Atlas eDiscovery Process Management Information Disclosure Vulnerability (CNVD-2018-00312)

IBM Atlas eDiscovery Process Management helps attorneys, paralegals, and evidence supervisors rigorously and logically manage legal evidence retention workflows. An information disclosure vulnerability exists in IBM Atlas eDiscovery Process Management 6.0.3. An authenticated attacker could exploi...

TIBCO Security Advisory: December 12, 2017 - tibbr -2017-5534

Improper sandboxing of a third-party component in tibbr Original release date: December 12, 2017 Lastrevised: -- CVE-2017-5534 Source: TIBCO SoftwareInc. Improper sandboxing of a third-party component in tibbr Original release date: December 12, 2017 Last revised: -- Source: TIBCO Software Inc...

TIBCO Security Advisory: December 12, 2017 - tibbr -2017-5534

Improper sandboxing of a third-party component in tibbr Original release date: December 12, 2017 Lastrevised: -- CVE-2017-5534 Source: TIBCO SoftwareInc. Improper sandboxing of a third-party component in tibbr Original release date: December 12, 2017 Last revised: -- Source: TIBCO Software Inc...

CVE-2017-1353

IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. IBM X-Force ID: 126680...

Information disclosure

IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. IBM X-Force ID: 126680...

CVE-2017-1353

IBM Atlas eDiscovery Process Management 6.0.3 could allow an authenticated attacker to obtain sensitive information when an unsuspecting user clicks on unsafe third-party links. IBM X-Force ID: 126680...

Denial of Service Against GlobalProtect

A vulnerability exists in PAN-OS that could lead to denying access to GlobalProtect portal, GlobalProtect gateway or preventing configuration commits. Ref PAN-78127 / CVE-2017-15942 PAN-OS contains a vulnerability in GlobalProtect that may allow a non-authenticated third party to mount a Denial o...

[R1] Nessus 6.11.3 Fixes Multiple Third-party Vulnerabilities

Nessus leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to upgrade t...

Google Cracks Down On Nosy Android Apps

Google is cracking down on unwanted and harmful Android apps with a new effort that will show warnings on applications and on third-party websites distributing apps that collect personal data without user consent. The effort is an expansion of the Google Safe Browsing team’s mission to enforce th...

Google to Block Third-Party Software from Injecting Code into Chrome Browser

To improve performance and reduce crashes caused by third-party software on Windows, Google Chrome, by mid-2018, will no longer allow outside applications to run code within its web browser. If you are unaware, many third-party applications, like accessibility or antivirus software, inject code...

CVE-2017-2694

The AlarmService component in HwVmall with software earlier than 1.5.2.0 versions has no control over calling permissions, allowing any third party to call. An attacker can construct a malicious application to call it. Consequently, alert music will be played suddenly, compromising user experienc...

Amazon Promises Fix to Stop Key Service Hack

Researchers at Rhino Security Labs identified a flaw in Amazon’s Key delivery service and Cloud Cam security camera that allows a rogue courier to tamper with the camera and knock it offline, making it appear no one is entering home, when that’s not the case. Amazon Key service allows homeowners ...

Forever 21 Warns Shoppers of Payment Card Breach at Some Stores

Another day, another data breach. This time a fast-fashion retailer has fallen victim to payment card breach. American clothes retailer Forever 21 announced on Tuesday that the company had suffered a security breach that allowed unknown hackers to gain unauthorized access to data from payment car...

[R1] SecurityCenter 5.6.0.1 Fixes Multiple Third-party Vulnerabilities

SecurityCenter leverages third-party software to help provide underlying functionality. Two of the third-party components PHP and OpenSSL were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable...

Augmented Reality games and real-world trolling

Augmented Reality games—where you wave a device around and the digital collides with reality— have been booming in popularity ever since Pokemon GO! rolled into mobile storefronts. However, many AR games haven't really been designed with the possible consequences of real-world safety in mind. Tak...

Google's Data on Login Thefts

This is interesting research and data: With Google accounts as a case-study, we teamed up with the University of California, Berkeley to better understand how hijackers attempt to take over accounts in the wild. From March 2016 to March 2017, we analyzed several black markets to see how hijackers...

Automattic: Improper markup sanitization.

Summary One can inject HTML into a note and create a login form that sends the user's details to a third-party server. This was a fun issue to play around with. I will let the PoC do most of the talking for a change. PoC Paste the following HTML into a Simplenote. I am using the Simplenote app...

CVE-2017-13815

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the third-party "file" product. Versions before 5.31 allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

CVE-2017-13815

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the third-party "file" product. Versions before 5.31 allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact...

IRCCloud: [IRCCloud Android] Theft of arbitrary files leading to token leakage

Bug description Hi, I'd like to report a vulnerability which allows to theft arbitrary protected files and as a result takeover account, because all tokens will be leaked, similar to my bug reported to Harvest https://hackerone.com/reports/161710 This one is really tricky, passed two days to...