Information Disclosure

github.com/openshift/origin is vulnerable to information disclosure. The vulnerability is possible because kubernetes watch cache does not return the correct data in a multi tenant environment, revealing the data of a user to another user...

Atlassian Resets HipChat Passwords Following Breach

Atlassian reset user passwords for its group chat service HipChat on Monday following an incident that may have resulted in unauthorized access to a server used by the service. The company began warning users Monday via email that as a result an attacker may have secured access to user informatio...

Hyundai Patches Leaky Blue Link Mobile App

Hyundai Motor America has patched a vulnerability in its Blue Link mobile application that exposed personal and vehicle information to an attacker. Updated versions of the app 3.9.6 were released to Google Play and the Apple App Store on March 8, a little more than one month after Rapid7 learned...

Google Pleads for Better Cross-Border Exchange of Digital Evidence

Google said it is receiving a growing number of cross-border requests for user data to be used as evidence in criminal prosecutions. The volume of requests is also exposing weaknesses in the existing process for exchanging data between countries called the Mutual Legal Assistance Treaties MLAT,...

Google Android Information Disclosure Vulnerability (CNVD-2017-04563)

Android is a cell phone operating system based on the Linux open kernel. Android has an information disclosure vulnerability during the factory settings restoration process that can be exploited by an attacker to access the previous user's data...

CIIC Xi'an Recruitment System Exploits Universal Password Login Vulnerability

CIIC Xi'an Recruitment System is a resume information saving and entry system. CIIC Xi'an Recruitment System suffers from a universal password login vulnerability. An attacker who enters the universal password 'or '1'='1 or 'or'='or' can log in and view sensitive user information...

Appointment Script - SQL Injection

Appointment Script - SQL Injection Exploit Title: Doctors Appointment Script - SQL Injection Google Dork: N/A Date: 05.04.2017 Vendor Homepage: http://appointment-script.com/ Software: http://appointment-script.com/demo Demo: http://appointment-script.com/demo Version: N/A Tested on: Win7 x64, Ka...

Appointment Script - SQL Injection

Exploit Title: Doctors Appointment Script - SQL Injection Google Dork: N/A Date: 05.04.2017 Vendor Homepage: http://appointment-script.com/ Software: http://appointment-script.com/demo Demo: http://appointment-script.com/demo Version: N/A Tested on: Win7 x64, Kali Linux x64 Exploit Author: Ihsan...

Maian Uploader 4.0 SQL Injection

Exploit Title: Maian Uploader Script v4.0 - SQL Injection Google Dork: N/A Date: 04.04.2017 Vendor Homepage: http://www.maiansoftware.com/ Software: http://www.maianuploader.com/?dl=yes Demo: http://www.maiansoftware.com/demos/uploader/ Version: 4.0 Tested on: Win7 x64, Kali Linux x64 Exploit...

Verizon to pre-install a 'Spyware' app on its Android phones to collect user data

If the death of online privacy rules wasn't enough for Internet Service Providers and advertisers to celebrate, Verizon has planned to pre-install spyware on customers' Android devices in order to collect their personal data. The telecom giant has partnered with Evie Launcher to bring a new...

TYPO3 Information Disclosure Vulnerability

TYPO3 is an open source content management system. An information disclosure vulnerability exists in TYPO3. The vulnerability is caused by sending an http request to the index.php?loginProvider URI in the https Referer. An attacker can exploit the vulnerability to obtain sensitive user informatio...

CVE-2017-7249

Multiple Cross-Site Scripting XSS were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data action, userid passed to the 'Gazelle-master/sections/tools/data/ocelotinfo.php' URL. An attacker could execute arbitrary HTML and script...

Cross site scripting

Multiple Cross-Site Scripting XSS were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data id passed to the 'slims7cendana-master/template/default/detailtemplate.php' and...

CVE-2017-6908

An issue was discovered in concrete5 = 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data fID passed to the "concrete5-legacy-master/web/concrete/tools/files/selectordata.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the...

Microsoft Internet Explorer Information Disclosure (MS17-006: CVE-2017-0059)

Information disclosure vulnerabilities exists in Microsoft Internet Explorer. This vulnerability is due to improper handling of objects in memory. A successful exploitation could result in an out-of-bounds read and access to private user data...

Information leakage vulnerability in Yunmai Good Light APP

Yunmai Good Light APP is a special app for smart weight scale launched by Yunmai. There is an information leakage vulnerability in Yunmai Good Light APP. Since the entire APP only uses token as a security restriction, the token generation algorithm can be cracked to obtain sensitive information,...

CVE-2017-5626

OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands 4F500301 and 4F500302 that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code...

Design/Logic Flaw

OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands 4F500301 and 4F500302 that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code...

Domain Marketplace Script - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Domain Marketplace Script - SQL Injection Google Dork: N/A Date: 11.03.2017 Vendor Homepage: http://scripteen.com/ Software: http://scripteen.com/item/scripts/scripteen-domain-marketplace-script.html Demo:...

CVE-2017-0490

An elevation of privilege vulnerability in Wi-Fi could enable a local malicious application to delete user data. This issue is rated as Moderate because it is a local bypass of user interaction requirements that would normally require either user initiation or user permission. Product: Android...