New Google Tools Help Devs Improve Content Security Policy Protection

Cross-site scripting is the cockroach of web application security vulnerabilities, enjoying continued longevity despite the abundant availability of scanning tools and programming advice designed to squash it. Google yesterday took another shot at eradicating XSS attacks with the release of two...

Batterii Mobile - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Batterii Mobile published at the 'play' market has multiple vulnerabilities...

Goblin News - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Goblin News published at the 'play' market has multiple vulnerabilities...

Microix Timesheet Module SQL Injection

Exploit Title: Microix timesheet module SQL Injection Google Dork: "Copyright by Microix" inurl:"/microixcloud/" Date: 2016-09-06 Software Link: http://www.microix.net/workflow-modules/timesheet-module/ Exploit Author: Anthony Cole Contact: http://twitter.com/acole76 Website:...

CVE-2016-0896

Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the allopen Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address...

Enpass Password Manager - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Enpass Password Manager published at the 'play' market has multiple vulnerabilities...

Uradio.uz - External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Uradio.uz published at the 'play' market has multiple vulnerabilities...

Telegraf.uz - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Telegraf.uz published at the 'play' market has multiple vulnerabilities...

Yandex.Transport - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Yandex.Transport published at the 'play' market has multiple vulnerabilities...

Open Redirect DDoS Tool: UFONet

Open Redirect DDoS Tool UFONet – is a tool designed to launch DDoS attacks against a target, using ‘Open Redirect’ vectors on third party web applications, like botnet. UFONet abuses OSI Layer 7-HTTP to create/manage ‘zombies’ and to conduct different attacks using; GET/POST, multithreading,...

Форекс Опционы - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Форекс Опционы published at the 'play' market has multiple vulnerabilities...

Intercepting Proxy for Performing Web Application Security Testing: The Pappy Proxy

Intercepting Proxy for Performing Web application security testing The Pappy P roxy A ttack P roxy P rox Y Proxy is an intercepting proxy for performing web application security testing. Its features are often similar, or straight up rippoffs from Burp Suite . However, Burp Suite is neither open...

Deniz Kabuğu - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Deniz Kabuğu published at the 'play' market has multiple vulnerabilities...

tripadvisor.fi XSS vulnerability

Open Bug Bounty ID: OBB-179079 Description| Value ---|--- Affected Website:| tripadvisor.fi Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Legal Robot: Legal | Application is Missing CSP(Content Security Policy) Header

-Content Security Policy Header used to allow only source code to execute in the application from the domain mentioned in its list. By using this we can restrict code to execute which is written in application either by developer or by Hacker -Since application contains no such header i am going ...

CVE-2016-3193

Fortinet CVE-2016-3193 is an XSS flaw in the FortiManager/FortiAnalyzer appliance web-application. Affected: FortiManager 5.x (before 5.0.12, before 5.2.6, before 5.4.1) and FortiAnalyzer 5.x (before 5.0.13, before 5.2.6, before 5.4.1). Root cause: unobstructed insertion of script/HTML by remote ...

Traveloka Book Flight & Hotel - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Traveloka Book Flight & Hotel published at the 'play' market has multiple vulnerabilities...

GitLab - 'impersonate' Feature Privilege Escalation

Exploit for ruby platform in category web applications Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi...

GitLab - 'impersonate' Feature Privilege Escalation

Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website: https://kaimi.ru CVE: CVE-2016-4340 Category:...

Microsoft Education - Stored Cross Site Web Vulnerability

Document Title: =============== Microsoft Education - Stored Cross Site Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1897 Release Date: ============= 2016-08-10 Vulnerability Laboratory ID VL-ID: ====================================...