Old Android Flaw Elevates Privileges, Steals SMS, Call Logs

A five-year-old Android vulnerability disclosed today affects hundreds of different device models going back to Jelly Bean 4.3. Older devices are at the greatest risk; newer devices running Android with SE Android, the OS’ implementation of Security Enhanced Linux, are at a lesser risk. The...

Exploiting CVE-2016-2060 on Qualcomm Devices

Mandiant’s Red Team recently discovered a widespread vulnerability affecting Android devices that permits local privilege escalation to the built-in user “radio”, making it so an attacker can potentially perform activities such as viewing the victim’s SMS database and phone history. The...

Aurora Forecast - Exported components, External URLs, Possible privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application Aurora Forecast published at the 'play' market has multiple vulnerabilities...

Northern Eye Aurora Forecast - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Northern Eye Aurora Forecast published at the 'play' market has multiple vulnerabilities...

Aurora Notifier - External URLs, Suspicious files, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Aurora Notifier published at the 'play' market has multiple vulnerabilities...

Northern Lights FREE (Aurora) - External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Northern Lights FREE Aurora published at the 'play' market has multiple vulnerabilities...

AppLock Theme Aurora - Exported components vulnerabilities

HackApp vulnerability scanner discovered that application AppLock Theme Aurora published at the 'play' market has multiple vulnerabilities...

IBM WebSphere Commerce Open Redirection Vulnerability

IBM WebSphere Commerce is a suite of e-commerce solutions. The solution supports all sales business models, including B2C, B2B, and B2B2C, on a single customer interaction platform.Aurora starter store is one of the page layout tools. An open redirection vulnerability exists in the Aurora starter...

CVE-2013-6124

The Qualcomm Innovation Center QuIC init scripts in Code Aurora Forum CAF releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a 1 chown or 2 chmod command, as demonstrated by changing the permissions of an arbitrary file via...

Command injection

The Qualcomm Innovation Center QuIC init scripts in Code Aurora Forum CAF releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a 1 chown or 2 chmod command, as demonstrated by changing the permissions of an arbitrary file via...

Code injection

A certain Qualcomm Innovation Center QuIC patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum CAF releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption...

CVE-2013-6124

The Qualcomm Innovation Center QuIC init scripts in Code Aurora Forum CAF releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a 1 chown or 2 chmod command, as demonstrated by changing the permissions of an arbitrary file via...

CVE-2013-2599

A certain Qualcomm Innovation Center QuIC patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum CAF releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption...

DHS Releases Hundreds of Documents on Wrong Project Aurora

In response to a Freedom of Information Act request for information about the Operation Aurora attack on Google and other organizations in 2009 the Department of Homeland Security released hundreds of pages of documents related not to that attack campaign, but to the Aurora project run at Idaho...

Internet Explorer "Aurora" Memory Corruption

No description provided by source. $Id: ms10002aurora.rb 9787 2010-07-12 02:51:50Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

Code Aurora多个产品'CONFIG_STRICT_MEMORY_RWX'安全限制绕过漏洞

BUGTRAQ ID: 65630 CVECAN ID: CVE-2013-4737 Code Aurora Forum是Linux基金会协同项目。 Code Aurora多个项目的CONFIGSTRICTMEMORYRWX功能没有正确考虑某些内存区段，在实现中存在安全漏洞，这可使远程攻击者通过固定位置的RWX内存，利用此漏洞绕过目标访问限制。 0 Code Aurora QRD Android Code Aurora Firefox OS for MSM Code Aurora Android for MSM 厂商补丁： Code Aurora -----------...

Chinese hackers who breached Google in 2010 gained access to thousands of surveillance orders

In 2010, as part of what has been dubbed as Operation Aurora, Chinese hackers infiltrated a special database within Google's systems and gained access to a sensitive database worth of information about American surveillance targets. Google reported the hack publicly years ago, saying that the...

Chinese hackers who breached Google in 2010 gained access to thousands of surveillance orders

In 2010, as part of what has been dubbed as Operation Aurora, Chinese hackers infiltrated a special database within Google’s systems and gained access to a sensitive database worth of information about American surveillance targets. Google reported the hack publicly years ago, saying that the...

Netcraft.com Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: www.netcraft.com - Search Form Cross-site Scripting vulnerability Advisory ID: SSCHADV2013-008 Author: Stefan Schurtz Affected Software: Successfully tested on www.netcraft.com Vendor URL: http://www.netcraft.com Vendor Status: fixed...

APT1-Themed Spear Phishing Campaign Linked to China

Researchers at Seculert have discovered a link between spear phishing campaigns targeting Japanese and Chinese journalists, post-Mandiant’s APT1 report, and domains connected to the Aurora attacks on Google and the Shady RAT campaign. In particular, in the attacks against the Japanese, the malwar...