Família GM - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Família GM published at the 'play' market has multiple vulnerabilities...

Yahoo Football - كرة قدم - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Yahoo Football - كرة قدم published at the 'play' market has multiple vulnerabilities...

bsh -- remote code execution vulnerability

Stian Soiland-Reyes reports: This release fixes a remote code execution vulnerability that was identified in BeanShell by Alvaro Muñoz and Christian Schneider. The BeanShell team would like to thank them for their help and contributions to this fix! An application that includes BeanShell on the...

Algolia: PHP version disclosed on blog.algolia.com

Hi ON BLOG.ALGOLIA.COM PHP application version is disclosed in response header "X-Powered-By" POC is attached...

MultiGO Топливо - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application MultiGO Топливо published at the 'play' market has multiple vulnerabilities...

Netentsec ASG 网康应用安全网关 resetpwd.php SQL注入

No description provided by source...

Open Source Database Fuzzing: FuzzDB

FuzzDB is the most comprehensive Open Source database of malicious inputs, predictable resource names, greppable strings for server response messages, and other resources like web shells. It’s like an application security scanner, without the scanner. What’s in FuzzDB? Predictable Resource...

MGASA-2016-0019 Updated ruby-mail packages fix security vulnerability

The Mail library does not impose a length limit on email addresses, so an attacker can send a long spam message via a recipient address unless there is a limit on the application's side. The attacker-injected message in the recipient address is processed by the server. This type of vulnerability...

Many Health and Fitness Apps Remain Vulnerable

It seems little has changed over the last several years when it comes to how health and fitness apps go about securing user information. According to a survey carried out by the firm Arxan last fall, 86 percent of health apps it reviewed at had at least two critical vulnerabilities and 55 percent...

By multipart/form-data bypass the waf-vulnerability warning-the black bar safety net

LuManager high-riskSQL injection0day analysis mentioned in the monitoring to use the payload as follows: ! You can see the attacker using the multipart/form-data format send the payload to. For applications, and using application/x-www-form-urlencoded access to the data is consistent. About...

F5 Networks BIG-IP : QEMU vulnerability (SOL51841514)

hw/ide/core.c in QEMU does not properly restrict the commands accepted by an ATAPI device, which allows guest users to cause a denial of service or possibly have unspecified other impact via certain IDE commands, as demonstrated by a WINREADNATIVEMAX command to an empty drive, which triggers a...

A step-by-step learn the ROP of the Android ARM 3 2-vulnerability warning-the black bar safety net

ROP stands for Return-oriented programming return-oriented programming this is an advanced memory attack techniques that can be used to bypass the modernoperating systema variety of common defenses such as the memory is not performed and code signing. Before we mainly discussed on linux in this...

Amazon Linux AMI : libpng (ALAS-2015-615)

It was discovered that the pnggetPLTE and pngsetPLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer...

webapps.icma.org XSS vulnerability

Vulnerable URL: https://webapps.icma.org/pm/9402/public/cover.cfm?author=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 10:11 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

LG Nortel Disclosure / Insecure Configuration / DoS

Title: LG Nortel ADSL modems - Multiple vulnerabilities Discovered by: Karn Ganeshen Vendor Homepage: NA Version Reported: Board ID: DV2020+Product Version: S1.064B2.3H0-0 + Software Version: 3.04L.02V.sip.LE9500.dspApp3341A2pB022f.d19e Timelines April, 2015: Vulnerabilities found April 2015:...

SAP NetWeaver 7.4 XXE Injection

Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of Public Advisory: 11.08.2015 Reference: SAP Security Note 2168485 Author: Roman Bezhan...

lib32-libpng: multiple issues

CVE-2015-7981 out-of-bounds read This is an array indexing error, which can lead to an out-of-bounds read of a static buffer. The result is now unsigned no longer negative, but now a huge positive number. - CVE-2015-8126 arbitrary code execution Buffer overflow vulnerabilities in functions...

PHPMyLicense 3.0.0 - 3.1.4 - DoS Exploit

Exploit for php platform in category dos / poc Exploit Title: PHPMyLicense Stored Cross Site Scripting Date: 09-10-2015 Exploit Author: Aria Akhavan Rezayat @ Websec GesmbH Website: https://websec-test.com Vendor Homepage: https://phpmylicense.com Software Link:...

xpshop网店系统sql注入再来一处

简要描述： 应该还有几个就收工了，其实还有一些，不过感觉好累不想弄了。再挖多几个就收工了！ 详细说明： 漏洞位置xpshop.webui.IspOrderReturnBy： protected void PageLoadobject sender, EventArgs e base.Response.AddHeader"Pragma", "No-Cache"; base.Response.Buffer = true; base.Response.ExpiresAbsolute = DateTime.Now.AddSeconds-1.0; base.Response.Expires = 0...

Xtreme Vulnerable Web Application: XVWA

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security. It’s not advisable to host this application online as it is designed to be “Xtremely Vulnerable”. It is recommended to host this application in local/controlled environment an...