Android Security Bulletin—February 2018Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2018-02-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Crowdfire: Social Media Manager - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Crowdfire: Social Media Manager published at the 'play' market has multiple vulnerabilities...

ZEIT Next.js Directory Traversal Vulnerability (CNVD-2018-03103)

ZEIT Next.js is an open source general-purpose webapps development framework . A directory traversal vulnerability exists in ZEIT Next.js version 4 prior to 4.2.3. An attacker can exploit this vulnerability to access front-end JavaScript components or possibly obtain sensitive data...

Untappd - Discover Beer - BSD license, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Untappd - Discover Beer published at the 'play' market has multiple vulnerabilities...

Skype, Slack and Other Popular Windows Apps Vulnerable to Critical Framework Bug

UPDATE Hundreds of software applications built using the developer framework called Electron may be vulnerable to a remote code execution flaw, according to developers of the framework. Impacted are dozens of popular Windows applications such as Microsoft’s Skype for Windows and Slack. Earlier th...

HQ Trivia (Unreleased) - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application HQ Trivia Unreleased published at the 'play' market has multiple vulnerabilities...

A coin miner with a “Heaven’s Gate”

You might call the last two years the years of ransomware. Ransomware was, without a doubt, the most popular type of malware. But at the end of last year, we started observing that ransomware was losing its popularity to coin miners. It is very much possible that this trend will grow as 2018...

UPDATE: OWASP Dependency-Check 3.1.0

PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 3.1.0! This release comes with...

Security and Quality Rollup for .NET Framework (January 2018)

The .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities: - A Denial of Service vulnerability exists when .NET, and .NET core, improperly process XML documents. An attacker who successfully exploited this...

January 3, 2018—KB4056897 (Security-only update)

None None...

Android Security Bulletin—January 2018Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2018-01-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Dojo by BullGuard - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Dojo by BullGuard published at the 'play' market has multiple vulnerabilities...

Sound Waves can Help Hackers Disrupt Functions of Hard Disk Drives

By Waqas Hard Disk Drives HDDs are most commonly used storage components This is a post from HackRead.com Read the original post: Sound Waves can Help Hackers Disrupt Functions of Hard Disk Drives...

Asus_GlobalWirteOverflow

Vulnerability: Global buffer overflow in networkmap ------------------------------------------ Exploitation: Can write data at any address in heap ------------------------------------------ Vendor of Product: Asus wireless router ------------------------------------------ Affected Products and...

Layering multiple Office Components (Word, Visio, Project, Outlook, etc.)

There are a couple of places this can go bad. One is, never run any Office component in the Install Machine. The first time Office runs, it writes some machine-specific information into the registry, and if that layer then wakes up on another machine, it has to go through the configuration again...

CVE-2017-1746

IBM Jazz for Service Management IBM Tivoli Components 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 135519...

CVE-2017-1746

IBM Jazz for Service Management IBM Tivoli Components 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 135519...

Cross site request forgery (csrf)

IBM Jazz for Service Management IBM Tivoli Components 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 135519...

CVE-2017-1746

CVE-2017-1746 affects IBM Jazz for Service Management (JazzSM) version 1.1.3, vulnerable to Cross-Site Request Forgery (CSRF) that could enable malicious actions transmitted from a trusted user. Remediation is available: JazzSM 1.1.3 with Cumulative Patch Level 5 (1.1.3.0-TIV-JazzSM-DASH-Cumulati...

CVE-2017-1746

IBM Jazz for Service Management IBM Tivoli Components 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 135519...