Remember, Good technology is no match to BAD implementation - - Apple's code-signing API that could make it easier for malicious programs to bypass the security check, potentially leaving millions of Apple users vulnerable to hackers.

NOTE - This is NOT a vulnerability in MacOS itself but a flaw in how third-party security tools implemented Apple's code-signing API

Code-signing mechanism is a vital weapon in the fight against malware, which helps users identify who has signed the app and also provides reasonable proof that it has not been altered.


However, Pitts found that the mechanism used by most products to check digital signatures is trivial to bypass, allowing malicious files bundle with a legitimate Apple-signed code to effectively make the malware look like it has been signed by Apple.


https://thehackernews.com/2018/06/apple-mac-code-signing.html

Dots do not matter in Gmail so, what is the Risk? - It Helps scammers. Check this Netflix scam.

The scam fundamentally relies on the Gmail user responding to an email with the assumption that it was sent to their canonical address, and not to some other address from their infinite address set.

Some Gmail power users might claim: “The dots-don’t-matter feature is great. I get ownership of an infinite set of email addresses!” But firstly, no one wants this infinite set of email addresses. Those who really want infinite addresses already have the “plus labelling” feature

Not only do Gmail users not want these extra addresses, most are not even aware that they have these addresses

https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user.html

User credentials stored in plaintext in GmbH Nova-Wind Turbine - Can cause a loss of power for all attached systems

Lazy programmer + Bad Tester (if there was any testing at all)


From the article:

Researcher Maxim Rupp discovered the vulnerability in the Nova-Wind Turbine HMI and reported it to the vendor. However, the vendor has been unresponsive

The vulnerability results from the fact that the software stores user credentials in plain text.

“Successful exploitation of this vulnerability allows the ID to be retrieved from the browser and will allow the default ID to be changed. This exploit can cause a loss of power for all attached systems,” an advisory from ICS-CERT says. 

For more details:
https://threatpost.com/plaintext-credentials-threaten-rle-wind-turbine-hmi/113354