Google Is Finally Making Chrome Extensions More Secure

Third-party developers don't always build extensions with security best practices in mind. Now Google is taking steps to better protect user data...

News aggregator app Flipboard hacked; user data stolen

By Uzair Amir Hackers managed to breach Flipboard’s security for sensitive database multiple times putting millions of users at risk. Just yesterday, it was reported that the online graphic-design tool website Canva had suffered a massive data breach in which a hacker stole over 139 million...

Unauthorized Access Vulnerability in Collaborative Office System of Yunnan Ruoshui Network Technology Co.

Yunnan Ruoshui Network Technology Co., Ltd. is an Internet service company. An unauthorized access vulnerability exists in the collaborative office system of Yunnan Ruoshui Network Technology Co. An attacker can obtain sensitive information of website users by brute force cracking...

EUVD-2019-0473

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a...

WordPress WPGraphQL Access Control Error Vulnerability (CNVD-2019-27674)

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WPGraphQL is a plugin that provides an extensible GraphQL architecture and API for WordPress sites. An access control error vulnerabili...

PT-2019-8016

Name of the Vulnerable Software and Affected Versions Open-Xchange GmbH OX App Suite versions 7.8.4 and earlier Description The issue is related to Cross Site Scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations For version...

Authentication flaw

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

Millions of Golfers Land in Privacy Hazard After Cloud Misconfig

Finding cloud databases with sensitive information left open to the internet has become par for the course these days – as a new exposure of millions of sensitive data points for the users of a golf app demonstrates. Millions of golfer records from the Game Golf app, including GPS details from...

Cross-site Scripting (XSS)

tomcat-catalina is vulnerable to cross-site scripting XSS. The vulnerability is possible because it outputs unsanitized user provided data for SSI printenv, allowing the attacker to inject arbitrary script through it...

CVE-2019-11809

An issue was discovered in Joomla! before 3.9.6. The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...

CVE-2019-11809

An issue was discovered in Joomla! before 3.9.6. The debug views of comusers do not properly escape user supplied data, which leads to a potential XSS attack vector...

CVE-2019-5954

JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass access restriction to obtain or alter the user's registered information via unspecified vectors...

Hackers Breach Stack Overflow Q&A Site, Some Users' Data Exposed

Note: We have updated this story to reflect new information after Stack Overflow changed its original announcement and shared more details on the security incident. Stack Overflow, one of the largest question and answer site for programmers, revealed today that unknown hackers managed to exploit ...

PT-2019-7932

Name of the Vulnerable Software and Affected Versions OX Software GmbH App Suite versions prior to 7.8.4 Description The issue is related to Cross Site Scripting XSS, which is a type of attack that can be used to steal user data or take control of user sessions. Recommendations For versions prior...

PT-2019-12436

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository Manager versions 2.x through 2.14.12 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker injects malicious code into a website, allowing them to steal user data or ta...

Design/Logic Flaw

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for deciphering communications between this application and the backend server. This, in combination with...

CVE-2018-18979

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction of the initialization vector is necessary for deciphering communications between this application and the backend server. This, in...

Rabbit Movie CMS has xss vulnerability

Rabbit TV CMS is an open source content building system. A cross-site scripting vulnerability exists in Rabbit Movie CMS. Attackers can use this vulnerability to embed malicious code in web pages to obtain users' personal information or steal administrator cookie information...

Rabbit Movie CMS has xss vulnerability

Rabbit TV CMS is an open source content building system. A cross-site scripting vulnerability exists in Rabbit Movie CMS. Attackers can use this vulnerability to embed malicious code in web pages to obtain users' personal information or steal administrator cookie information...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins Static Analysis Utilities Plugin 1.95 and earlier in the DefaultGraphConfigurationViewdoSave form handler method allowed attackers to change the per-job default graph configuration for all users...