FC Bayern Munich (China) - Base64 encoded String, Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application FC Bayern Munich China published at the 'play' market has multiple vulnerabilities...

Super Deals In China Shopping - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Super Deals In China Shopping published at the 'play' market has multiple vulnerabilities...

China Shopping - Dangerous filesystem permissions, MIT license, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application China Shopping published at the 'play' market has multiple vulnerabilities...

Big Sale In China - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Big Sale In China published at the 'play' market has multiple vulnerabilities...

Prices in China. Shopping mall - Dangerous filesystem permissions, Exported ContentProvider, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Prices in China. Shopping mall published at the 'play' market has multiple vulnerabilities...

China Gadgets - Die Gadget App - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application China Gadgets - Die Gadget App published at the 'play' market has multiple vulnerabilities...

Root Servers Were Not Targets of 2015 DDoS Attack

When the Internet’s root name servers are in the line of fire of a DDoS attack, people start to sweat, and with good reason since they are the authoritative servers used to resolve IP addresses. The most recent attacks against the root servers happened over a two-day period starting last Nov. 30,...

Microsoft built a special version of Windows 10 just for Chinese Government

China is very strict about censorship, which makes it difficult for companies to launch their products in the country. But companies like Microsoft are playing smartly to target the largest market in the world. Microsoft has found a way to enter into the banned Chinese Market, but this time with...

Wiping Out a Malicious Campaign Abusing Chinese Ad Platform

At FireEye Labs, we have discovered another well-crafted malvertising campaign that uses the ad API of one of the world’s largest search engines: China-based Baidu. The attacker employs a simple HTML redirector instead of shellcode or an exploit in an apparently benign-looking website. This leads...

Trojan Exploits Apple DRM Flaw And Can Plant Malware On Non-Jailbroken iOS Devices

Apple iOS devices are in the crosshairs of another malware attack that has already infected an estimated six million non-jailbroken iOS devices in China, according to researchers. Palo Alto Networks found the new malware called AceDeceiver that infects iOS devices via Windows PCs and which...

Starbucks China - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Starbucks China published at the 'play' market has multiple vulnerabilities...

ruvar OA系统 bulletin_template_show.aspx 参数id SQL注入漏洞

0x01 框架概述 璐华RuvarOA机关事业版办公自动化系统是广州市璐华计算机科技有限公司专门针对我国党政机关、大型企事业单位开发，采用组件技术和Web技术相结合，基于Windows平台，构建在大型关系数据库管理系统基础上的，以行政办公为核心，以集成融通业务办公为目标，将网络与无线通讯等信息技术完美结合在一起设计而成的新型办公自动化应用系统。 该系统根据中国国情和行政管理的惯例，旨在从根本上提高办公及行政管理的效率和水平，并借助与计算机与信息科技的成果为领导和决策人员提供全面及时的决策支持服务，是颇具实用性、先进性、经济性的政府机关协同办公系统。...

Russia Wants to Kick Foreign Tech Companies Out Of The Nation

Someone wants to kick Microsoft, Google and Apple off from his land, but himself uses Gmail and Mac. The newly appointed Internet Tsar German Klemenko, who is the first internet advisor of Vladimir Putin, wants to kick off American Giants from Russia. In a 90-minute interview conducted by...

Linux kernel denial of service vulnerability (CNVD-2016-00855)

Linux kernel is an open source operating system. Linux kernel has a security vulnerability that allows attackers to conduct denial of service attacks...

dhl.com.cn XSS vulnerability

Vulnerable URL: http://www.dhl.com.cn/Outcome.php?searchstr=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 785218 Google Pagerank| 2 V...

big5.airchinagroup.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-125643 Description| Value ---|--- Affected Website:| big5.airchinagroup.com Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N Remediation Guide:| OWASP Open Redirect Cheat Sheet...

2014-2015 Professional Reading Round-Up

At an earlier point in my career, I used to read a lot of technical security books. From 2006 to 2012 I published a series of Best Book Bejtlich Read posts. Beginning in 2013 I became much more interested in military-derived strategy and history, dating back to my studies at the Air Force Academy...

Memory Corruption Vulnerability in China Knowledge CAJViewer Reader Processing PDF Format Files

CAJViewer is a specialized full-text format reader for the China Journal Network, which is very heavily used. The reader in the processing of PDF file format when there is a memory corruption vulnerability, the construction of malformed PDF file format can lead to a program crash, if successfully...

China Passes Anti-Terrorism Law; Here's What You Need to Know

If you rely on encrypted services to keep your data private and, unfortunately, you are in China, then you are about to be worried. As of now Chinese government could snoop into the operations of technology companies as well as circumvent privacy protections in everyday gadgets. China So-called...

The EPS Awakens - Part 2

On Wednesday, Dec. 16, 2015, FireEye published The EPS Awakens, detailing an exploit targeting a previously unknown Microsoft Encapsulated Postscript EPS dict copy use-after-free vulnerability that was silently patched by Microsoft on November 10, 2015. The blog described the technical details of...