17-Year-Old Found Bugs in WhatsApp Web and Mobile App

Last week, the most popular mobile messaging application WhatsApp finally arrived on the web — dubbed WhatsApp Web, but unfortunately it needs some improvements in its web version. An independent 17-year-old security researcher Indrajeet Bhuyan reported two security holes in the WhatsApp web clie...

MegaChat — Kim Dotcom launches end-to-end encrypted Video Calling Service

Are you worried about your privacy? Its Obvious because of a Hacker or the government could be snooping in your emails, voice or video calls. The Famous Internet entrepreneur Kim Dotcom, who introduced legendary Megaupload and Mega file sharing services to the World, has now released its latest...

Apache Traffic Server Unsupported

According to its banner, the version of Apache Traffic Server running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network...

Spammers Take A Liking to WhatsApp Mobile App

Spammers have settled in on the WhatsApp messaging platform with greater regularity, aided in one locale, by of all things, government regulations. Researchers at AdaptiveMobile yesterday published a report that exposed a number of spam campaigns peddling phony handbags and sunglasses, investment...

Panasonic Arbitrator Back-End Server (BES) Information Disclosure Vulnerability

Panasonic Arbitrator is a surveillance camera application. A security vulnerability exists in the Panasonic Arbitrator 'Back-End' Server, which could be exploited by an attacker to obtain sensitive information...

CVE-2014-9596

Panasonic Arbitrator Back-End Server BES MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive...

Directory traversal

Panasonic Arbitrator Back-End Server BES MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive...

CVE-2014-9596

Panasonic Arbitrator Back-End Server BES MK 2.0 VPU before 9.3.1 build 4.08.003.0, when USB Wi-Fi or Direct LAN is enabled, and MK 3.0 VPU before 9.3.1 build 5.06.000.0, when Embedded Wi-Fi or Direct LAN is enabled, does not use encryption, which allows remote attackers to obtain sensitive...

[SECURITY] [DLA 134-1] curl security update

Package : curl Version : 7.21.0-2.1+squeeze11 CVE ID : CVE-2014-8150 Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted U...

CVE-2014-8151

The darwinsslconnectstep1 function in lib/vtls/curldarwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL aka SecureTransport back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to...

Peerio — End-to-End Encrypted Secure Messenger and File Sharing App

On one end, where governments of countries like U.K is criticizing end-to-end encryption and considering to ban the encrypted communication apps like Snapchat, CryptoCat, WhatsApp and Apple’s iMessage. On the other hand, the Internet community has come up with a new and rather more secure encrypt...

Got a Smartphone with Android 4.3 or earlier? No WebView Vulnerability Patch for You

Owning a smartphone running Android 4.3 Jelly Bean or an earlier versions of Android operating system ?? Then you are at a great risk, and may be this will never end. Yes, you heard right. If you are also one of millions of users still running Android 4.3 Jelly Bean or earlier versions of the...

DLA-134-1 curl - security update

Bulletin has no description...

Debian DSA-3122-1 : curl - security update

Andrey Labunets of Facebook discovered that cURL, an URL transfer library, fails to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to do additional requests in...

[SECURITY] [DSA 3122-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3122-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 08, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3122-1] curl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3122-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso January 08, 2015 http://www.debian.org/security/faq -...

DSA-3122-1 curl - security update

Bulletin has no description...

KenWards-Zipper-1.400

This exploit takes advantage of the fact too many characters get mangled, as a result I was able to get a shell in a more straight forward way. Very interesting exercise. Mrme and tecR0c figured out this trick, of course. But I was given the honor to share it. Zip file format based on:...

[SECURITY] Fedora 21 Update: python-django-horizon-2014.1.3-2.fc21

Horizon is a Django application for providing Openstack UI components. It allows performing site administrator viewing account resource usage, configuring users, accounts, quotas, flavors, etc. and end user operations start/stop/delete instances, create/restore snapshots, view instance VNC consol...

phpyun v3.2 (20141222) 前台注入 #5

简要描述： 目测最后一发。 详细说明： 在member/model/blacklist.class.php中 function saveaction ifisarray$POST'buid'&&$POST'buid' $company=$this-obj-DBselectall"company","uid in".@implode',',$POST'buid'."","uid,name";//直接整合成字符串后 带入查询 没有经过自带的pylode处理 或者 intval 和单引号 导致了注入 foreach$company as $val...