Instagram Accidentally Exposed Some Users' Passwords In Plaintext

Instagram has recently patched a security issue in its website that might have accidentally exposed some of its users' passwords in plain text. The company recently started notifying affected users of a security bug that resides in a newly offered feature called "Download Your Data" that allows...

New Android API Lets Developers Push Updates Within their Apps

You might have read somewhere online today that Google is granting Android app developers powers to forcefully install app updates…but it is not true. Instead, the tech giant is providing a new feature that will help users to have up-to-date Android apps all the time and yes, it's optional. Along...

New Android API Lets Developers Push Updates Within their Apps

You might have read somewhere online today that Google is granting Android app developers powers to forcefully install app updates…but it is not true. Instead, the tech giant is providing a new feature that will help users to have up-to-date Android apps all the time and yes, it's optional. Along...

apvfilms.com XSS vulnerability

Open Bug Bounty ID: OBB-619910 Description| Value ---|--- Affected Website:| apvfilms.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Under Armour Reports Massive Breach of 150 Million MyFitnessPal Accounts

UPDATE Fitness apparel firm Under Armour said 150 million users of its MyFitnessPal app are victims in a breach exposing user names, email addresses and hashed passwords. The company said personal identifiable information such as credit card numbers and social security numbers were not part of th...

Yahoo Hacked Once Again! Quietly Warns Affected Users About New Attack

Has Yahoo rebuilt your trust again? If yes, then you need to think once again, as the company is warning its users of another hack. Last year, Yahoo admitted two of the largest data breaches on record. One of which that took place in 2013 disclosed personal details associated with more than 1...

Deleted page with restrictions notified all users

h2. Summary Restricted page was deleted, user were restricted from that page receive email notification about the page was deleted. h3. h3. Steps to replicate Create 2 users with the name User A and User B. User A created a space called Notification and created a page called Testing. User A...

CVE-2016-9212

Cisco Web Security Appliance (WSA) Drop Decrypt Policy Bypass (CVE-2016-9212) is caused by incomplete HTTP header input validation in the Decrypt for End-User Notification configuration. Under HTTPS decryption, an unauthenticated remote attacker could connect to a blocked HTTPS website despite po...

Mail.ru: [my.mail.ru] HTML injection в письмах от [email protected]

1 Создаем группу и приглашаем в нее пользователей https://my.mail.ru/my/editcommunity 2 Меняем название группы на !-- 3 Устанавливаем пользователям права модератора или смотрителя https://my.mail.ru/community/blahblahgroup/communityaccess 4 Откатываем права и меняем название назад В результате...

Gratipay: auto-logout after 20 minutes

Hi, Session is not getting expired even after keeping the application idle for 20 min and after browser closure. Information: JavaScript code can be used by the web application in all or critical pages to automatically logout client sessions after the idle timeout expires, for example, by...

Yahoo to Warn Users of State-Sponsored Attacks

Yahoo has announced it will follow in the footsteps of Twitter and Facebook and begin warning users when it believes their accounts have been targeted by a state-sponsored actor. Bob Lord, who was hired as the company’s new CISO in October, discussed the initiative in a blog post Monday. Lord sai...

Thousands of Mozilla Developers Emails and Password Exposed Accidentally

Mozilla on Friday notified users of its Mozilla Developer Network MDN that the company has accidentally exposed the e-mail addresses and cryptographically protected passwords of thousands of Mozilla developers. The email addresses of over 76,000 members of its Developer Network, along with 4000...

Honeywell Tema Remote Installer ActiveX Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

eBay Password Database Hack Raises Questions

As is the case with most high-profile data breaches, despite an initial disclosure of information, more questions are inevitable. The eBay password database hack is a prime example. Inquiring minds still want to know more about how the stolen passwords are secured and why the online auction house...

New Guidelines Explain How Apple will Legally Process Law Enforcement Data Requests

Despite the contrary regarding NSA’s DROPOUTJEEP program, Apple had always denied working with the NSA in the creation of any backdoors used to spy on its users and also claimed that the NSA doesn't have backdoor access to its data. But, Apple could legally share your phone data with the law...

CVE-2013-2916

Removed by vendor...

Inaccessible page titles leaked by Share Page API

The Share Page API exposes a REST endpoint that is available to authenticated users of Confluence. It is possible for any user to share any page simply by specifying the corresponding numeric id and the resulting notification includes the title of the shared page. In particular, a user may obtain...

Facebook Underplays Data Exposed by DYI Bug

It would seem that a bug in Facebook’s Download Your Information tool that exposed personal information for six million users of the social network also extends to non-users who happen to be in a contact list uploaded to the site. Facebook said it has repaired the bug and began informing users th...

Honeywell Tema Remote Installer - ActiveX Remote Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Honeywell Tema...

Honeywell Tema Remote Installer ActiveX Remote Code Execution

This module exploits a vulnerability found in the Honeywell Tema ActiveX Remote Installer. This ActiveX control can be abused by using the DownloadFromURL function to install an arbitrary MSI from a remote location without checking source authenticity or user notification. This module has been...