Shuanet Adware Roots Android Devices

A new strain of adware buried in repackaged popular Android applications is able to root devices and earn its keepers a tidy $2 per installation. Shuanet behaves more like malware and shares some heritage with two other adware families—Kemoge and Shedun—that also root devices and give their...

fr.puma.com XSS vulnerability

Vulnerable URL: http://fr.puma.com/frFR/stores?location='"...

FreeBSD : p5-Dancer -- possible to abuse session cookie values (968d1e74-1740-11e5-a643-40a8f0757fb4)

Russell Jenkins reports : It was possible to abuse session cookie values so that file-based session stores such as Dancer::Session::YAML or Dancer2::Session::YAML would attempt to read/write from any file on the filesystem with the same extension the file-based store uses, such as '.yml' for the...

Magento remote code execution vulnerability analysis report-vulnerability warning-the black bar safety net

Check Point company researchers recently in Magento e-Commerce network platform on which to found a dangerous remote code execution RCE）vulnerabilities, the vulnerabilities could cause the Magento platform on the e-shops of all hackers, including credit card information and some other property an...

Magento Patched Remote Execution Hole in eCommerce Platform

A nasty remote code execution vulnerability was recently patched in eBay’s eCommerce platform Magento. The hole, disclosed Monday, could put upwards to 200,000 company’s web stores, and their customers’ information at risk of being compromised. If exploited, researchers claim the vulnerability...

CVE-2015-0992

Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors...

Installer Hijacking Vulnerability in Android Devices

A vulnerability in Google's Android OS has been discovered that could allow an attacker to change or replace a seemingly safe Android application with malware during installation. An attacker exploiting this vulnerability could access and steal user data on compromised devices without user...

CVE-2015-0073: Undefined Security Weakness

The Windows Registry Virtualization feature in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict changes to virtual stores, which allows loca...

KLA10589 Multiple vulnerabilities in Microsoft products

Multiple serious vulnerabilities have been found in Microsoft products. Malicious users can exploit these vulnerabilities to gain privileges, bypass security restrictions, cause denial of service or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper memory...

Sql injection

Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the 1 iDisplayLength or 2 iDisplayStart parameter to a commentspaginate.php or b storespaginate.php in admin/ajax/...

PT-2015-3678

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns SQL injection vulnerabilities in the admin area. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. The vulnerabilities are specifically related...

Malicious Ads on Yahoo, AOL, Trigger CryptoWall Infections

Attackers have been leveraging the FlashPack Exploit Kit to peddle the CryptoWall 2.0 ransomware on unsuspecting visitors to sites such as Yahoo, The Atlantic and AOL. Researchers believe that for about a month the malvertising campaign hit up to 3 million visitors and netted the attackers $25,00...

CVE-2014-5829

The Hobby Lobby Stores aka com.hobbylobbystores.android application 2.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5829

CVE-2014-5829 affects the Hobby Lobby Stores Android app (package com.hobbylobbystores.android) version 2.1.9, where SSL/TLS server certificates are not verified. This weakness allows MITM attackers to spoof servers and obtain sensitive information via a crafted certificate, compromising confiden...

CVE-2014-5829

The Hobby Lobby Stores aka com.hobbylobbystores.android application 2.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5829: Undefined Security Weakness

The Hobby Lobby Stores aka com.hobbylobbystores.android application 2.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Fake 'Placebo Apps' Booted From Google Play, Amazon

A handful of apps purporting to specialize in virus detection and malware scanning were recently removed from Google’s Play marketplace and Amazon after being deemed fake. Security researchers at FireEye discovered five apps in particular that accounted for up to 50,000 downloads and essentially...

Amazon Web Services Combing Third Parties for Credentials

Amazon Web Services is actively searching a number of sources, including code repositories and application stores, looking for exposed credentials that could put users’ accounts and services at risk. A week ago, a security consultant in Australia said that as many as 10,000 secret Amazon Web...

Turkish Hacker Crashes Google Play Store Twice while testing vulnerability

Last Weekend Google Play Store was crashed twice by a Turkish hacker when he tried to test vulnerability he discovered on the Android apps publishing system, known as Google's Developer Console. Turkish hacker 'Ibrahim Balic' claimed responsibility for the Google Play Store attack and told 'The...

Magento vulnerability allows an attacker to create administrative user

It seems you cannot go a day without hearing about someone or some group hacking a website or stealing credit card and other sensitive data from e-commerce sites. The Market of E-commerce is at its boom, and that provides even more opportunities to hackers. There are many readymade e-commerce...