Threatpost News Wrap Podcast for Nov. 3

Threatpost editors Mike Mimoso and Tom Spring discuss the week’s top information security news stories, including Google’s decision to drop HTTP Public Key Pinning in Chrome, a vulnerability in Google’s Issue Tracker, Mozilla’s decision to ban Canvas Fingerprinting, and a HTTPS issue with...

Researcher Identifies Bugs in Google’ Bug Tracker Program

By Uzair Amir A security researcher has identified bugs in Google’s bug tracker This is a post from HackRead.com Read the original post: Researcher Identifies Bugs in Google’ Bug Tracker Program...

Flaw in Google Bug Tracker Exposed Reports About Unpatched Vulnerabilities

Google’s Issue Tracker, also known internally as the “Buganizer,” contained until recently a vulnerability that would allow an external party access to any unpatched bug listed and described in the database. Alex Birsan, a software developer and hobbyist bug-hunter, collected more than $15,000 in...

Debian DLA-1145-1 : zoneminder security update

Multiple vulnerabilities have been found in zoneminder. This update fixes only a serious file disclosure vulnerability CVE-2017-5595. The application has been found to suffer from many other problems such as SQL injection vulnerabilities, cross-site scripting issues, cross-site request forgery,...

Issuetracker phpBugTracker Cross-Site Scripting Vulnerability

Issuetracker phpBugTracker is a web-based defect tracking system. The system provides features such as project management and defect tracking services. A cross-site scripting vulnerability exists in Issuetracker phpBugTracker versions prior to 1.7.0. This vulnerability can be exploited by remote...

CVE-2015-2142

Multiple cross-site request forgery CSRF vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to 1 hijack the authentication of users for requests that cause an unspecified impact via the id parameter to project.php, 2 hijack the authentication of users for...

yubacitybears.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-320336 Description| Value ---|--- Affected Website:| yubacitybears.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Fitbit’ Fitness Tracker Devices Leak Personal Data: Researchers

By Waqas We do know that the inherent flaws in wearable devices This is a post from HackRead.com Read the original post: Fitbit’ Fitness Tracker Devices Leak Personal Data: Researchers...

SQLMap v1.1.8 - Automatic SQL Injection And Database Takeover Tool

SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lastin...

Premium Servers List Tracker 1.0 SQL Injection

Exploit Title: Premium Servers List Tracker v1.0 a SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...

Premium Servers List Tracker 1.0 - SQL Injection

Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...

CVE-2017-12061

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by...

Cross-site Request Forgery (CSRF)

Moodle is vulnerable to cross-site request forgery CSRF attacks. A session key isn't present when setting a tracker preference. This allows remote attackers to hijack the authentication of users requesting a tracker preference...

Geo Tracker - GPS tracker - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Geo Tracker - GPS tracker published at the 'play' market has multiple vulnerabilities...

Request Tracker (RT) 4.x < 4.2.12 Multiple XSS Vulnerabilities

Request Tracker RT is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Request Tracker (RT) 4.x < 4.0.25, 4.2.x < 4.2.14, 4.4.x < 4.4.2 Multiple Vulnerabilities

Request Tracker RT is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 26 : libupnp (2017-23535a31f8)

miniserver: fix binding to ipv6 link-local addresses - Fix out-of-bound access in createurllist CVE-2016-8863 - If the error or info log files can not be created, use stderr and stdout instead. - SF Bug Tracker 132 CVE-2016-6255: write files via POST Note that Tenable Network Security has...

voipratetracker.com XSS vulnerability

Vulnerable URL: http://www.voipratetracker.com/redirect/top.php?out.%22%3EKeritzy%3Cimg%20src=x%20onerror=prompt%28/xssposed/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 13.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Best Practical Solutions Request Tracker Information Disclosure Vulnerability

Best Practical Solutions Request Tracker RT is an enterprise-grade, open source issue tracking system from Best Practical Solutions in the United States. The system has Bug tracking , customer service , customized workflow and other features . A security vulnerability exists in Best Practical...

Request Tracker Cross-Site Scripting Vulnerability (CNVD-2017-21554)

Best Practical Solutions Request Tracker RT is an enterprise-grade, open source issue tracking system from Best Practical Solutions in the United States. The system has Bug tracking , customer service , customized workflow and other features . A cross-site scripting vulnerability exists in Best...