New Malware Replaced Legit Android Apps With Fake Ones On 25 Million Devices

Are you sure the WhatsApp app you are using on your Android device is legitimate, even if it's working perfectly as intended? ...Or the JioTV, AppLock, HotStar, Flipkart, Opera Mini or Truecaller app—if you have installed any of these? I'm asking this because cybersecurity researchers just...

Nine Charged in Alleged SIM Swapping Ring

Eight Americans and an Irishman have been charged with wire fraud this week for allegedly hijacking mobile phones through SIM-swapping, a form of fraud in which scammers bribe or trick employees at mobile phone stores into seizing control of the target's phone number and diverting all texts and...

PYSEC-2019-63

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...

Explained: like-farming

Like-farming, aka like-harvesting, is a method used by commercial parties and scammers alike to raise the popularity of a site or domain. The ultimate dream of every like-farmer is for his post to go viral by accumulating as many likes and shares as possible from all over the world. Like-farmers...

UBUNTU-CVE-2019-11324

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...

Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR

Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR / A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replacement OSR allows the compilation of JITed functions that cause type confusions between...

Netartmedia PHP Mall 4.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Netartmedia PHP Mall 4.1 - Multiple SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/mall/ Demo Site: https://www.phpscriptdemos.com/mall/ Version: 4.1 Tested on: Kali Linux CVE: N/A...

MobSTSPY Info-Stealing Trojan Goes Global Via Google Play

An Android spyware dubbed MobSTSPY has managed to ride trojanized apps to a widespread, global distribution, mainly via Google Play. The malware masquerades as a legitimate application purporting to be things like flashlights, games and work productivity tools. While it’s not uncommon to come...

Malware on SHEIN Servers Compromises Data of 6.4M Customers

Email addresses and encrypted passwords of over 6.4 million SHEIN customers were stolen over the summer after the women’s retailer said it suffered a “concerted criminal cyberattack” on its computer network. The data breach occurred between June and August 2018, the company said in a recent...

AV-Comparatives: Trend Micro Mobile Security for Android Provides 100% Malware Protection for Mobile Users

With the introduction of Android v8.0 Android Oreo in August of 2017, among other OS improvements Google introduced its built-in malware protection for Android call Play Protect dependent on Google Play Services 11 or later. Play Protect checks apps and APK files downloaded from Google Play or...

Design/Logic Flaw

Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie...

PT-2018-18401

Name of the Vulnerable Software and Affected Versions: Apache Ambari versions 2.5.0 through 2.6.2 Description: The issue exposes passwords for Hadoop credential stores in Ambari Agent informational log messages when the credential store feature is enabled for eligible services, such as Hive and...

CVE-2018-8042: Generation of Error Message Containing Sensitive Information

Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie...

OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)

Vulnerability in the Java SE, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java...

OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)

Vulnerability in the Java SE, JRockit component of Oracle Java SE subcomponent: Security. Supported versions that are affected are Java SE: 6u181, 7u171, 8u162, 10 and JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java...

Ecessa Edge EV150 10.7.4 CSRF Add Superuser Exploit

Summary Internet Failover and Load Balancing for Small Businesses, Stores and Branch Offices. Description The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain...

Shopify Elevation of Privilege Vulnerability

Shopify is a Canadian business company headquartered in Ottawa, Ontario, Canada, which develops computerized software point-of-sale systems for online stores and retailing. Shopify has an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...

Security Bulletin: IBM Worklight and IBM Mobile Foundation application authenticity bypass (CVE-2014-0888)

Summary IBM Worklight and IBM Mobile Foundation application authenticity verification can be bypassed under certain conditions. Vulnerability Details CVEID: CVE-2014-0888 DESCRIPTION: The application authenticity feature in IBM Worklight and IBM Mobile Foundation enables the Worklight server to...

Error: "404 - File or directory not found" when launching new stores created on StoreFront

New stores created on StoreFront are showing error: "404 - File or directory not found" at launch. Old stores can be launched properly...

EulerOS 2.0 SP2 : java-1.7.0-openjdk (EulerOS-SA-2018-1129)

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenJDK: incorrect handling of Reference clones can lead to sandbox bypass.CVE-2018-2814 - OpenJDK: unrestricted deserialization of...