Nasty Android Malware that Infected Millions Returns to Google Play Store

HummingBad – an Android-based malware that infected over 10 million Android devices around the world last year and made its gang an estimated US$300,000 per month at its peak – has made a comeback. Security researchers have discovered a new variant of the HummingBad malware hiding in more than 20...

Chinese Ad Firm Infected 85 Million Android Users to Get More Clicks

An Android-based malware campaign has been found to control as many as 85 million Android devices globally and is making its gang an estimated $300,000 per month in fraudulent ad revenue. A Chinese advertising company called Yingmob is responsible for distributing the malware on a massive scale a...

Android version of Baidu browser remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

! A few weeks ago, I was in the Baidu Android browser, found a remote code execution vulnerability. Initially I wanted to at this year's Infiltrate on about this subject until I see the following XDA developers weekend published articles. Overview The above article discusses the Citizen Lab...

WordPress NewStatPress Plugin 0.9.8 xss+sql注入

主题地址：https://wordpress.org/plugins/newstatpress/影响版本：0.9.8Active installs: 20,000+CVE: CVE-2015-4062, CVE-2015-40631）sql注入 CWE-89 CVE-2015-4062 CODE:includes/nspsearch.php:94for$i=1;$i=3;$i++ if$GET"what$i" != '' && $GET"where$i" != '' $where.=" AND ".$GET"where$i"." LIKE '%".$GET"what$i"."%'";...

Mozilla: Add-on notification bypass through data URLs (MFSA 2015-95)

A flaw was found in the way Firefox handled installation of add-ons. An attacker could use this flaw to bypass the add-on installation prompt, and trick the user into installing an add-on from a malicious source...

WordPress Landing Pages 1.8.4 Cross Site Scripting / SQL Injection Vulnerabilities

WordPress Landing Pages plugin version 1.8.4 suffers from cross site scripting and remote SQL injection vulnerabilities. Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage:...

WordPress GigPress 2.3.8 SQL Injection Vulnerability

WordPress GigPress plugin version 2.3.8 suffers from a remote SQL injection vulnerability. Title: SQLi vulnerabilities in WordPress plugin "GigPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/gigpress/ Active installs: 20,000+...

UBUNTU-CVE-2015-0812

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdoma...

[SECURITY] Fedora 20 Update: cobbler-2.6.3-1.fc20

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. There is also a web interface 'cobbler-web'. Cobbler's advanced features include importing...

Oracle Business Transaction Management FlashTunnelService Remote Code Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

PT-2014-3449 · Openstack +1 · Openstack Heat Templates +1

Name of the Vulnerable Software and Affected Versions: OpenStack Heat Templates heat-templates as used in Red Hat Enterprise Linux OpenStack Platform version 4.0 Description: The issue allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors, as GPG signature...

DEBIAN-CVE-2013-2201

Multiple cross-site scripting XSS vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 uploads of media files, 2 editing of media files, 3 installation of plugins, 4 updates to plugins, 5 installation of themes, or 6 updat...

Download Kali Linux, from the creators of BackTrack

Great news for Hackers and Backtrack Linux fans! The most awaited penetration testing Linux distribution has been released called 'Kali Linux' or 'Backrack 6', from the creators of BackTrack itself. From last 7 years we have seen five awesome versions of Backtrack Linux. But this time to achieve...

WordPress < 3.4.2 Multiple Vulnerabilities

According to its version number, the WordPress install hosted on the remote web server is affected by multiple vulnerabilities : - The application is affected by an unspecified bug that affects multisite installs with untrusted users. - The application is affected by an unspecified vulnerability...

wordpress -- multiple unspecified privilege escalation bugs

Wordpress reports: Version 3.4.2 also fixes a few security issues and contains some security hardening. The vulnerabilities included potential privilege escalation and a bug that affects multisite installs with untrusted users. These issues were discovered and fixed by the WordPress security team...

Fedora 17 2012-9621

Cobbler is a network install server. Cobbler supports PXE, virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. There is also a web interface 'cobbler-web'. Cobbler's advanced features include importing...

FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution

This module exploits FreePBX version 2.10.0,2.9.0 and possibly older. Due to the way callmepage.php handles the 'callmenum' parameter, it is possible to inject code to the '$channel' variable in function callmestartcall in order to gain remote code execution. Please note in order to use this modu...

IBM DB2 8.1 < Fix Pack 18 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 8.1 running on the remote host is affected by one or more of the following issues : - A local attacker may be able to gain write access to an arbitrary file using DAS, which could lead to gaining root privileges. IZ34149 - It may be possible t...

Fedora 10 : mediawiki-1.14.0-45.fc10 (2009-2231)

This update fixes the XSS vulnerabilities in 1.13.3 and splits the package into a non-math and a full package to allow for smaller installs where embedded math is not required. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Fedora Core 10 FEDORA-2009-2231 (mediawiki)

The remote host is missing an update to mediawiki announced via advisory FEDORA-2009-2231. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...