OAuth2. 0 deploy properly, billions of Android Apps account memory leak risk-vulnerability warning-the black bar safety net

The University of Hong Kong, three security researchers have found that many support single sign-on App no the correct deployment of OAuth2. 0 authentication Protocol, the attacker can use this vulnerability to remotely login to any user's App account. Ronghai Yang, Wing Cheong Lau and Tianyu Liu...

Microsoft Edge and Internet Explorer XSS Filter CVE-2016-7239 Information Disclosure Vulnerability

Description Microsoft Edge and Internet Explorer are prone to an information-disclosure vulnerability that affects the XSS Filter. An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. An attacker can exploit this issue to execute...

'Web Of Trust' Browser Add-On Caught Selling Users' Data — Uninstall It Now

Browser extensions have become a standard part of the most popular browsers and essential part of our lives for surfing the Internet. But not all extensions can be trusted. One such innocent looking browser add-on has been caught collecting browsing history of millions of users and selling them t...

Android development APP end common security vulnerability interpretation-sensitive information disclosure vulnerability-vulnerability warning-the black bar safety net

As is known, Android system because of its open-source, open, flexible feature allows the smartphone industry with the rapid progress, the cut-off 2 0 1 5 in the fourth quarter, Android smartphone market share reached 8 0. 7%, but at the same time, Android Open, Open Source advantage from another...

WhatsApp Blasted by EU Data Protection Group Over Facebook Sharing

Yet another privacy coalition is urging WhatsApp to clarify that user information shared between the company and Facebook is compliant with data protection laws on the books in Europe. The Article 29 Working Party, comprised of representatives from data protection authorities from each EU member...

Uber: ability to retrieve a user's phone-number/email for a given inviteCode

The www.uber.com/a/join?invitecode=inviteCode endpoint returned email and/or phone number for the user with the invite code inviteCode. Since protecting our users data is our top priority, we were very interested in this report. It was also a pleasure to work with @kushal89shah and we look forwar...

Apple iOS/tvOS/macOS Information Disclosure Vulnerability

Apple iOS is a set of operating systems developed for mobile devices; tvOS is a smart TV operating system; and watchOS is a smart watch operating system. A security vulnerability in CFNetwork Proxies in several Apple products allows remote attackers to exploit the vulnerability to gain access to...

IBM Security Guardium Information Disclosure Vulnerability

IBM Security Guardium is a data activity monitor product from IBM USA. The product offers features such as automated controls for compliance and protection against internal and external threats. IBM Security Guardium suffers from an information disclosure vulnerability. A remote attacker could...

Palm Zhenyi app design loophole

Palm ZJI APP is a mobile application developed by the First Hospital Affiliated to Zhejiang University School of Medicine ZJU-S1 to alleviate the tediousness of traditional medical consultation time. A design vulnerability exists in the Palm ZJI App. An attacker can bypass the check by constructi...

XSS Vulnerability in NetEase Mail Client IOS Version

NetEase Mail Client is a general-purpose email client launched by NetEase 163. An XSS vulnerability exists in the IOS version Ver3.9 of NetEase Mail Client. It allows attackers to insert malicious js code in the page to obtain user cookies and other information, resulting in user hijacking...

USN-3103-1 libdbd-mysql-perl vulnerabilities

It was discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker could use this issue to cause DBD::mysql to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2014-9906 Hanno Böck discovered that DBD::mysql incorrectly handled certa...

Google Handles Record Number of Government Requests for Data

Google fielded a record number of government requests for user data during the first half of 2016, according to its updated Transparency Report. It was also able to report that it received at least one National Security Letter during the six months between July and December 2015. “Pursuant to the...

Microsoft Browser Information Disclosure Vulnerability

An information disclosure vulnerability exists when affected Microsoft scripting engines do not properly handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. In a web-based attack scenario, an attacker could host a website that is us...

Subpoena for Signal Messaging Data Renders Little

Open Whisper Systems, the non-profit group behind the encrypted messaging app Signal, was served with a subpoena for user data earlier this year but since the company keeps such little information on its users, it was unable to produce most of what it was asked for. The American Civil Liberties...

Germany Orders Facebook to Stop Collecting Data on WhatsApp Users

A German privacy regulator issued an order this week prohibiting Facebook from collecting user data on German WhatsApp users, calling the company’s actions misleading and in violation of the nation’s data protection law. The move comes a few weeks after a recent WhatsApp policy change that said t...

Germany Bans Facebook From Collecting WhatsApp Data

Just last month, the most popular messaging app WhatsApp updated its privacy policy and T&Cs to start sharing its user data with its parent company, and now both the companies are in trouble, at least in Germany and India. Both Facebook, as well as WhatsApp, have been told to immediately stop...

Multiple Reflective Cross-Site Scripting Vulnerabilities in BINOM3 Electric Power Quality Meter

The BINOM3 Electric Power Quality Meter is a universal multifunctional power quality monitor. BINOM3 Electric Power Quality Meter suffers from multiple reflected cross-site scripting vulnerabilities. These vulnerabilities can be exploited to inject arbitrary JavaScript at a specially crafted URL,...

CVE-2016-1000219

A flaw was found in Kibana's logging functionality. If custom logging output was configured in Kibana, private user data could be written to the Kibana log files. A system attacker could use this data to hijack sessions of other users when using Kibana behind some form of authentication such as...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Enterprise Kibana security update

An update for Red Hat OpenShift Enterprise Kibana images is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

PHP 'ext/gd/gd.c' Heap Buffer Overflow Vulnerability

PHP is an open source general-purpose computer scripting language. PHP 'ext/gd/gd.c' suffers from a heap buffer overflow vulnerability due to the program failing to adequately filter user-supplied data. Allowing an attacker to exploit the vulnerability would allow execution of arbitrary script co...