Ancient streaming media system /VIEWGOOD/ADI/portal/UserDataSync. aspx file UserGUID parameter SQL injection vulnerability

No description provided by source...

Vtiger CRM does not properly restrict access to application data

Overview Vtiger CRM is a customer relationship management CRM software. Vtiger CRM contains a vulnerability where it does not properly restrict access to user information data. Hirota Kazuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with th...

JVN#01956993: Vtiger CRM does not properly restrict access to application data

Vtiger CRM is a customer relationship management CRM software. Vtiger CRM contains a vulnerability where it does not properly restrict access to user information data. Impact A user with user privileges may create new users or alter existing user information. Solution Update the software Update t...

Google, Niantic to Limit Data Pokémon GO Collects

Niantic, Inc. – the company behind the ubiquitous, can’t-go-10-minutes-without-hearing-about-it Pokémon GO game – said Monday night it wasn’t the company’s intent to request full access permission of its users’ Google accounts. The company, a Google spinoff, was put in the crosshairs over its...

BMW in-car infotainment system ConnectedDrive aeration remote control 0day vulnerabilities-vulnerability warning-the black bar safety net

! ConnectedDrives is the BMW car infotainment system, The system can move the APP to manage the vehicle. In addition to the APP, the system also provides a complete Web application. Vulnerability lab security researcher BenjaminKunz Mejri in to the BMW official submission of a vulnerability five...

SIMATIC WinCC OA Privilege Escalation

The vulnerability of the SIMATIC Winn CC OAM software lies in the use of a weak hashing algorithm for hashing user account data. Exploiting this vulnerability allows a malicious individual to elevate their privileges by using a brute-force method...

CVE-2016-5231

Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and delete user data via a crafted app...

CVE-2016-5231

Summary: CVE-2016-5231 affects Huawei Mate 8 and related NXT/NXT variants (NXT-AL, NXT-CL, NXT-DL, NXT-TL) prior to certain build revisions. The issue allows an attacker to bypass permission checks and delete user data via a crafted app. The vulnerability is linked to Huawei’s security advisories...

CVE-2016-5231: Undefined Security Weakness

Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and delete user data via a crafted app...

PT-2016-6316

Name of the Vulnerable Software and Affected Versions Huawei Mate8 versions NXT-AL10C00B182 and earlier Huawei Mate8 versions NXT-CL00C92B182 and earlier Huawei Mate8 versions NXT-DL00C17B182 and earlier Huawei Mate8 versions NXT-TL00C01B182 and earlier Description The issue allows attackers to...

Cross-site scripting vulnerability

A cross-site scripting vulnerability exists in the web interface whereby data provided by the user is stored without sanitization. Ref 90635 CVE-2016-2219. This issue affects the management interface of the device, where an authenticated administrator may be tricked into injecting malicious...

PT-2016-5071

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions 7.0.1 through 7.0.7 Description A cross-site scripting issue exists in the management interface of the device, allowing remote authenticated users to inject arbitrary web script or HTML. This occurs because...

Bomgar Remote Support - Unauthenticated Code Execution (Metasploit)

Exploit for linux platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Bomgar Remote Support Unauthenticated Code Execution', 'Description' = %q Thi...

LebiShop Mall Log Unauthorized Access Vulnerability

LebiShop mall system is an online mall system using ASP.NET language. The system is widely used in small and medium-sized e-commerce enterprises. The payment-related log information of this mall system is stored in the Web directory and uses date commands, and the log files leak sensitive...

53快服平台某漏洞涉及760w用户信息+百万聊天工人信息+消息

简要描述： RT 详细说明： post注入语法：sqlmap.py -r 6.txt -D talk --count --tables 延迟注入慢的不行跑了25小时左右 ======================数据包========================= POST /lword.php HTTP/1.1 Host: www5.53kf.com Proxy-Connection: keep-alive Content-Length: 364 Origin: http://www5.53kf.com User-Agent: Mozilla/5.0 Windows NT 6.1...

China wants Apple's Source Code, but the Company Refused

In Brief Apple's head of legal has denied all rumors about providing its complete source code or any backdoor to the Chinese government. Apple officially confirmed that the Chinese government has asked Apple twice in the past two years to hand over the source code for its operating system, but th...

Google Stresses Transparency in New Chrome Web Store Policies

Google last week put app developers on notice, urging them to comply with a new set of privacy policies that it plans on enforcing starting this summer designed to better promote transparency. The rules reflect an update to Google’s User Data Policy for the Chrome Web Store. The company has porte...

SAP NetWeaver Java AS RTC Service Information Disclosure Vulnerability

SAP NetWeaver is SAP's integrated technology platform and the technology foundation for all SAP applications since SAP Business Suite. A security vulnerability exists in the chat function of the RTC service in SAP NetWeaver Java AS version 7.4, which can be exploited by remote attackers to obtain...

Reddit Removes NSL Warrant Canary from Transparency Report

Reddit’s latest transparency report is missing a nugget of information that was present in a previous report. Last year’s report included a warrant canary which stated that as of Jan. 29, 2015, Reddit had never received a National Security Letter, Foreign Intelligence Surveillance Court order or...

Uber: Possibility to enumerate and bruteforce promotion codes in Uber iOS App

Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo. Thanks, @r0t! Uber has a feature in the iOS app to apply a promotion...