Fake Android apps caught dropping Coinhive miner

By Waqas In October last year, three Android apps on Play Store This is a post from HackRead.com Read the original post: Fake Android apps caught dropping Coinhive miner...

January 5, 2017 – Morning Cyber Coffee Headlines – “Monopoly” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 5, 2018 - Headlines Carbon Black in the News: Cybersecurity news round-...

Google Play Removes 22 Malicious ‘LightsOut’ Apps From Marketplace

Nearly two dozen Android flashlight and related utility apps were removed from the Google Play marketplace after researchers found a malicious advertising component dubbed “LightsOut” inside them. In total, the apps were downloaded between 1.5 and 7.5 million times. Security researchers at Check...

My Telekom - Hardcoded secrets, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application My Telekom published at the 'play' market has multiple vulnerabilities...

Play XML External Entity Injection Vulnerability

Play is a set of open source Java Web application framework. The framework is scalable , low resource consumption and so on. An XML external entity injection vulnerability exists in the Java XML functionality in Play versions prior to 2.2.6 and 2.3.x versions prior to 2.3.5. A remote attacker can...

Huawei UPnP DeviceUpgrade command injection

Added: 01/02/2018 BID: 102344 Background Huawei home routers support the DeviceUpgrade service type over the Universal Plug and Play UPnP protocol to facilitate upgrading of firmware. Problem A remote authenticated attacker can execute arbitrary commands injected into the NewStatusURL XML element...

Huawei UPnP DeviceUpgrade command injection

Added: 01/02/2018 BID: 102344 Background Huawei home routers support the DeviceUpgrade service type over the Universal Plug and Play UPnP protocol to facilitate upgrading of firmware. Problem A remote authenticated attacker can execute arbitrary commands injected into the NewStatusURL XML element...

Dojo by BullGuard - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Dojo by BullGuard published at the 'play' market has multiple vulnerabilities...

CVE-2014-3630

XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...

Xxe

XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...

CVE-2014-3630

XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...

CVE-2014-3630

Play framework’s Java XML processing (before 2.2.6 and 2.3.x before 2.3.5) is affected by CVE-2014-3630 via an XML External Entity (XXE) vulnerability. Crafted XML data can read arbitrary files, cause denial of service, or have unspecified impacts. The connected records confirm affected versions ...

PT-2017-5880

Name of the Vulnerable Software and Affected Versions: Play versions prior to 2.2.6 Play versions 2.3.x prior to 2.3.5 Description: The issue is related to an XML external entity XXE vulnerability in the Java XML processing functionality. This might allow remote attackers to read arbitrary files,...

CVE-2014-3630: Improper Restriction of XML External Entity Reference

XML external entity XXE vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data...

Fake Bitcoin Wallet Apps Found on Google Play Store

By Uzair Amir After non-stop malware attacks, Android users have a couple of new This is a post from HackRead.com Read the original post: Fake Bitcoin Wallet Apps Found on Google Play Store...

Google Play Boots 3 Fake Bitcoin Wallet Apps

Google moved quickly to kick three fake bitcoin wallet apps from its Google Play marketplace earlier this month after researchers at mobile security firm Lookout discovered them. The apps pretended to be legitimate bitcoin wallets, but instead were fake. Apps were designed to trick sellers to...

Password Stealing Apps With Over A Million Downloads Found On Google Play Store

Even after so many efforts by Google like launching bug bounty program and preventing apps from using Android accessibility services, malicious applications somehow manage to get into Play Store and infect people with malicious software. The same happened once again when security researchers...

Still Stealing

Two years ago in October 2015 we published a blogpost about a popular malware that was being distributed from the Google Play Store. Over the next two years we detected several similar apps on Google Play, but in October and November 2017 we found 85 new malicious apps on Google Play that are...

Ramco mHub - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Ramco mHub published at the 'play' market has multiple vulnerabilities...

Fast Followers Boost - Corrupted files, Exported components, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Fast Followers Boost published at the 'play' market has multiple vulnerabilities...