Serious Security Vulnerability Discovered in Promotion

Description I am writing to report a serious security vulnerability that we have uncovered. Specifically, we have found that promotions applied to certain client groups are still being honored even after the promotions are no longer applicable to those groups. This means that attackers can...

CVE-2023-23512

The issue was addressed with improved handling of caches. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. Visiting a website may lead to an app denial-of-service...

Apple tvOS 安全漏洞

Apple tvOS is a set of smart TV operating systems from Apple Inc. in the United States. A security vulnerability exists in Apple tvOS versions prior to 16.3, which stems from a cache handling issue, where accessing a website may result in an application denial of service...

Spoofing

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature...

eventsource: Exposure of Sensitive Information

A flaw was found in the EventSource NPM Package. The description from the source states the following message: "Exposure of Sensitive Information to an Unauthorized Actor." This flaw allows an attacker to steal the user's credentials and then use the credentials to access the legitimate website...

PT-2022-18985 · Verizon · Verizon 5G Home

Name of the Vulnerable Software and Affected Versions: Verizon 5G Home LVSKIHP outside devices through 2022-02-15 Description: The issue allows anyone with knowledge of the device's serial number to access a CPE admin website, for example, at the "10.0.0.1" IP address. The password for the verizo...

Update now! Google launches Chrome version 100 and fixes 28 vulnerabilities

Google has launched Chrome version 100 which, among other things, fixes 28 vulnerabilities. Other new security features include Safety Check, Enhanced Safe Browsing, and the ability to control website access to your location and device. Of the 28 vulnerabilities, none have been marked as critical...

CVE-2021-20834: Missing Authorization

Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS versions prior to 2.177.1 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

JVN#89126639: Nike App fails to restrict custom URL schemes properly

Nike App by Nike, Inc. provides the function to access a requested URL using Custom URL Scheme. The app does not restrict access to the function properly CWE-939 which may be exploited to direct the app to access any sites. Impact A remote attacker may lead a user to access an arbitrary website v...

Canopy Parental Control App Wide Open to Unpatched XSS Bugs

Canopy, a parental control app that offers a range of features meant to protect kids online via content inspection, is vulnerable to a variety of cross-site scripting XSS attacks, according to researchers. The attacks could range from a sneaky kid disabling the monitoring to a much more serious...

esc bug fix and enhancement update

The esc packages contain the Enterprise Security Client ESC, which allows the user to manage security smart cards. The primary function of the tool is to enroll smart cards, so that they can be used for common cryptographic operations, such as to secure e-mail and website access. Bug Fixes and...

CVE-2021-30720

A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers...

CVE-2021-20733

CVE-2021-20733 concerns Asken Diet (Android) where improper authorization in the handler for a custom URL scheme allows a remote attacker to steer a user to an arbitrary website via the vulnerable app. Affected versions are v3.0.0 through v4.2.x. The root cause is insufficient access control arou...

CVE-2021-20733

Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

CVE-2021-20733: Missing Authorization

Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット asken diet for Android versions from v.3.0.0 to v.4.2.x allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

Hot Pepper Gourmet App fails to restrict access permissions

Overview Hot Pepper Gourmet App provided by Recruit Co., Ltd. implements the function to access a requested URL using Custom URL Scheme. This function contains an improper access control vulnerability CWE-284 that may allow the vulnerable App to receive an request from an arbitrary App and execut...

CVE-2021-20715: Missing Authorization

Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

CVE-2021-20693: Missing Authorization

Improper access control vulnerability in Gurunavi App for Android ver.10.0.10 and earlier and for iOS ver.11.1.2 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

Input validation

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access...

CVE-2021-1799

A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access...