Vulnerability in the "My Orders" section of the Eastern Presentation Society App

East Presentation Club APP is a convenient hotel booking platform. An override access vulnerability exists in the "My Order" section of Dongcheng Club APP. An attacker can traverse the key fields to obtain sensitive information of other users through packet capture...

Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection

Exploit Title: Galaxy Forces MMORPG 0.5.8 - 'type' SQL Injection Dork: N/A Date: 2018-11-14 Exploit Author: Ihsan Sencan Vendor Homepage: http://galaxy.alyx.pl/ Software Link: https://excellmedia.dl.sourceforge.net/project/galaxyforces/galaxy/0.5.8/galaxy-0.5.8.7z Version: 0.5.8 Category: Webapps...

Yaddo Hotel App Has Override Access Vulnerability

Yaddo Hotel APP is a hotel booking service software. A vulnerability exists in Yaddo Hotel APP for override access. An attacker traverses the chainId field by grabbing packets to obtain sensitive information about other users...

Eastern Presentation Society APP has information leakage vulnerability

East Presentation Club APP is a hotel booking platform. An information disclosure vulnerability exists in the Dongcheng Club APP. It allows attackers to utilize a packet grabber tool to traverse the Key field to obtain sensitive information about other users...

The evolution of Microsoft Threat Protection, November update

At Ignite 2018, we announced Microsoft Threat Protection, a comprehensive, integrated solution securing the modern workplace across identities, endpoints, user data, cloud apps, and, infrastructure Figure 1. The foundation of the solution is the Microsoft Intelligent Security Graph, which...

Patched Facebook Vulnerability Could Have Exposed Private Information About You and Your Friends

In a previous blog we highlighted a vulnerability in Chrome that allowed bad actors to steal Facebook users’ personal information; and, while digging around for bugs, thought it prudent to see if there were any more loopholes that bad actors might be able to exploit. What popped up was a bug that...

Overstepping Access Vulnerability in Rattle Car Rental App

Rattle Rental App is a car rental app. There is an overstepping access vulnerability in Ringer Rental Car APP. Attackers can use the vulnerability to capture packets to obtain sensitive information of other users...

A DJI Bug Exposed Drone Photos and User Data

Researchers found that they could compromise DJI's single sign-on tokens, similar to the issue behind Facebook's massive breach this September...

CCTV News App Has Override Access Vulnerability

CCTV News App is a portal news app software. CCTV News APP has an override access vulnerability . Attackers can use this vulnerability to directly query other users' information by grabbing packets and modifying UID parameters...

SaltOS Erp Crm 3.1 r8126 - Database File Download

SaltOS Erp Crm 3.1 r8126 - Database File Download Exploit Title: SaltOS Erp, Crm 3.1 r8126 - Database File Download Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.saltos.org/ Software Link: http://download.saltos.org/?app=saltos&format=xul&arch=win32 Version:...

Site security & user friendliness: Top E-commerce qualities for 2018

By Carolina It seems security breaches have not just become common, but prevalent throughout society. Between allegations of hacking into voting systems, and then into the most influential social media platforms, digital security has never been more critical. Users and businesses alike must do al...

UK Slaps Facebook with $645K Fine Over Cambridge Analytica Scandal

The UK has fined Facebook $645,000 over Cambridge Analytica’s data harvesting practices, which exploited the data of 87 million users of the social network. That represents a gnat bite for the tech giant, which generated $5.1 billion in net profit in the second quarter of the year. However, the...

Facebook Fined £500,000 for Cambridge Analytica Data Scandal

Facebook has finally been slapped with its first fine of £500,000 for allowing political consultancy firm Cambridge Analytica to improperly gather and misuse data of 87 million users. The fine has been imposed by the UK's Information Commissioner's Office ICO and was calculated using the UK's old...

HPE UIoT Unauthorized Access Vulnerability Vulnerability

HPE UIoT is a suite of universal IoT platforms from Hewlett Packard Enterprise HPE, USA. The platform features data analytics, monetary safety and synchronization management. A security vulnerability exists in the DSM portal and DSM APIs in HPE UIoT. A remote attacker could exploit the...

bouncycastle: Information disclosure in GCMBlockCipher

It was found that an information disclosure flaw in Bouncy Castle could enable a local malicious application to gain access to user's private information...

Google to Encrypt Android Cloud Backups With Your Lock Screen Password

In an effort to secure users' data while maintaining privacy, Google has announced a new security measure for Android Backup Service that now encrypts all your backup data stored on its cloud servers in a way that even the company can't read it. Google allows Android users to automatically backup...

Academic Timetable Final Build 7.0 - Information Disclosure

\n"; printr$ver; echo "\n"; / Array sEcho = 10 iTotalRecords = 3 iTotalDisplayRecords = 3 aaData = Array 0 = Array 0 = testdb1 1 = testdb1 2 = ADMIN 3 = 6CC4E8CFFEAF202D7475BC906612F9A29A9C8117 1 = Array 0 = ADMIN 1 = admin 2 = ADMIN 3 = 4ACFE3202A5FF5CF467898FC58AAB1D615029441...

Academic Timetable Final Build 7.0 - Information Disclosure

Academic Timetable Final Build 7.0 - Information Disclosure \n"; printr$ver; echo "\n"; / Array sEcho = 10 iTotalRecords = 3 iTotalDisplayRecords = 3 aaData = Array 0 = Array 0 = testdb1 1 = testdb1 2 = ADMIN 3 = 6CC4E8CFFEAF202D7475BC906612F9A29A9C8117 1 = Array 0 = ADMIN 1 = admin 2 = ADMIN...

Shopify: H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link

Hi, This is unrelated to the Twine-template issue reported earlier as this would still be an issue if the template escape would be fixed. Background The incontextapplink is checked server-side if it's a correct shopifycloud.com-URL. The problem however is that userdata inside the URL is allowed. ...

IBM Security Key Lifecycle Manager Information Disclosure Vulnerability (CNVD-2018-24832)

IBM Security Key Lifecycle Manager formerly known as Tivoli Key Lifecycle Manager is a set of key lifecycle management software from IBM in the United States. The software provides key storage, key maintenance and key lifecycle management for storage devices. A security vulnerability exists in IB...