CVE-2019-17598

CVE-2019-17598 affects Lightbend Play Framework (2.5.x–2.6.23) and its play-ws component. When configured to proxy requests through an authenticated HTTP proxy, under high load, HTTPS connections to a target host may reveal proxy credentials to that host. Impact is information disclosure; details...

CVE-2019-17598

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

by.exonit.redmine.client:client-play26-ws_2.12 (>=5.0.0-rc1, <=5.0.0), ch.datascience:renku-commons_2.12 (0.2.0) +96 more potentially affected by CVE-2019-17598 via com.typesafe.play:play-ws_2.12 (>=2.6.0-m1, <=2.6.23)

com.typesafe.play:play-ws2.12 MAVEN version =2.6.0-m1, =5.0.0-rc1, =2.0.0-rc0, =1.0.0, =7.6.0play2.6, =10.0.0play2.6, =10.0.0play2.6, =10.0.0play2.6, =0.4.0, =0.4.0, =0.1.0, =0.2.3 - com.elegantmonkeys:lagom-javadsl-google-pubsub-broker2.12 1.0.0-rc1 -...

Information Disclosure

play-ws is vulnerable to information disclosure. The vulnerability exists through a regression caused by async-http-client that causes HTTP CONNECT requests set to an outbound HTTPS requests when using an authenticated proxy server...

PT-2019-15219

Name of the Vulnerable Software and Affected Versions Lightbend Play Framework versions 2.5.x through 2.6.23 Description An issue was discovered in the Lightbend Play Framework. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes expose the proxy credentials ...

CVE-2019-17598: Inadequate Encryption Strength

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host...

Android Keyboard App Could Swindle 40M Users Out of Millions

Researchers are warning users to delete a popular Android keyboard app that, once downloaded, makes unauthorized purchases of premium digital content. Google told Threatpost it has removed the app from its Google Play marketplace – but researchers say it was downloaded on at least 40 million phon...

Mysterious malware that re-installs itself infected over 45,000 Android Phones

Over the past few months, hundreds of Android users have been complaining online of a new piece of mysterious malware that hides on the infected devices and can reportedly reinstall itself even after users delete it, or factory reset their devices. Dubbed Xhelper, the malware has already infected...

This Week in Security News: Trend Micro Acquires Cloud Conformity and Apple Removes Malicious iOS Apps from App Store

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Trend Micro’s recent acquisition of Cloud Conformity. Also, read about a fake photo editing app on Google Play and the 17...

Apple Removes 17 Malicious iOS Apps From App Store

Researchers have uncovered 17 apps on Apple’s official App Store infected with malware. Apple has since removed the apps from the App Store – but a “significant” number of iOS users could have installed them, researchers said. Once downloaded, the malicious apps infect victims with a trojan...

42 Adware Apps with 8 Million Downloads Traced Back to Vietnamese Student

First of all, if you have any of the below-listed apps installed on your Android device, you are advised to uninstall it immediately. Cybersecurity researchers have identified 42 apps on the Google Play Store with a total of more than 8 million downloads, which were initially distributed as...

42 Adware Apps with 8 Million Downloads Traced Back to Vietnamese Student

First of all, if you have any of the below-listed apps installed on your Android device, you are advised to uninstall it immediately. Cybersecurity researchers have identified 42 apps on the Google Play Store with a total of more than 8 million downloads, which were initially distributed as...

Huawei Honor Play Cornell-AL00A has an unspecified vulnerability

The Huawei Honor Play Cornell-AL00A is a smartphone from Chinese company Huawei Huawei. A security vulnerability in previous versions of Huawei Honor Play Cornell-AL00A 9.1.0.321 C00E320R1P1T8, which stems from a logic judgment error, can be exploited by an attacker to modify the alarm clock...

CVE-2019-11765

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted...

UBUNTU-CVE-2019-11765

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted...

PT-2019-14905 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 4.5.8 Description: The issue concerns an unsanitized filename variable in the recording play.php file, which is base64 decoded and reflected in HTML. This leads to a potential XSS issue. Recommendations: For...

Belkin Wemo Switch 28B Input Validation Error Vulnerability

The Belkin Wemo Switch 28B is a smart outlet device from Belkin USA. A security vulnerability exists in the Belkin Wemo Switch 28B WW2.00.11057.PVT-OWRT-SNS version. A remote attacker can exploit this vulnerability to cause a denial of service by sending a StoreRules request with a specially...

Android users installed 172 malicious apps 335m times last month

By Waqas In September alone, over 335 million Android users were tricked into downloading malware-infected apps from the Google Play Store. This is a post from HackRead.com Read the original post: Android users installed 172 malicious apps 335m times last month...

Google Play Malicious Apps Racked Up 335M+ Installs In September

Despite Google’s stepped up efforts to ban malicious apps hosted on Google Play 172 harmful apps – installed 335 million times by users – have been discovered on the platform in September alone. ESET researcher Lukas Stefanko said on Tuesday that the majority of those 172 malicious apps were...

This Week in Security News: Fake Apps on iOS and Google Play and Social Media Security Issues

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the evolution of EDR to XDR and why your CISO should care, stock trading app attacks and fake gambling apps. Also, read about ho...