Triangle Rush - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Triangle Rush published at the 'play' market has multiple vulnerabilities...

3D Rollercoaster Rush NewYork - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application 3D Rollercoaster Rush NewYork published at the 'play' market has multiple vulnerabilities...

Rail Rush - Customized SSL, Dangerous filesystem permissions, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Rail Rush published at the 'play' market has multiple vulnerabilities...

Westbound: Gold Rush - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Westbound: Gold Rush published at the 'play' market has multiple vulnerabilities...

Uber: Open redirect on rush.uber.com, business.uber.com, and help.uber.com

@4lemon reported open redirects on rush.uber.com, business.uber.com, and help.uber.com which would have made it possible for an attacker to redirect a victim through to another arbitrary site without user interaction...

Uber: Full path disclosure on track.uber.com

The page at track.uber.com had verbose stack traces enabled, allowing an attacker to learn information about the libraries, technologies and system information used in Uber Rush. Thanks, @firs0v!...

How I Got Here: Marcus Ranum

​Dennis Fisher talks with security pioneer Marcus Ranum about writing an early Internet firewall at DEC, the security gold-rush era of the 1990s and early 2000s, why he never patented most of the ideas he has come up with and how he found peace of mind. Download: 17ranum.mp3 Music by Chris Gonsal...

CVE-2014-6895

The Throne Rush aka com.progrestar.bft application 2.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Throne Rush aka com.progrestar.bft application 2.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6895

The CVE-2014-6895 entry affects the Android app Throne Rush (package com.progrestar.bft) version 2.3.10. The issue is that the application does not verify X.509 certificates from SSL servers, which enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2014-6895

The Throne Rush aka com.progrestar.bft application 2.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5662

The Rail Rush aka com.miniclip.railrush application 1.9.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Rail Rush aka com.miniclip.railrush application 1.9.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5662

The Rail Rush aka com.miniclip.railrush application 1.9.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5662

CVE-2014-5662 affects the Android app Rail Rush (com.miniclip.railrush) version 1.9.0. The vulnerability is due to the app not performing X.509 certificate validation for SSL servers, which enables man-in-the-middle attackers to spoof trusted servers and exfiltrate sensitive information via a cra...

LiteForum 2.1.1 - SQL Injection

No description provided by source. !/usr/bin/perl use LWP::UserAgent; LiteForum 2.1.1 http://www.softtime.ru sql injection exploit work on all mysql versions by 1dt.w0lf RusH security team http://rst.void.ru --------------------------------------- greets 2: ghc www.ghc.ru Gh0st Security Team...

FreeBSD 2.x,HP-UX 9/10/11,kernel 2.0.3,Windows NT 4.0/Server 2003,NetBSD 1 loopback (land.c) DoS (5)

No description provided by source. source: http://www.securityfocus.com/bid/2666/info A number of TCP/IP stacks are vulnerable to a loopback condition initiated by sending a TCP SYN packet with the source address and port spoofed to equal the destination source and port. When a packet of this sor...

FTPRush 1.0 .610 Host Field Local Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21714/info FTPRush is prone to a local buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input data to an insufficiently sized buffer. An attacker can exploit this issue to execute...

Wing FTP Rush insufficient certificate validation

SSL certificate is not validated...

FTP Rush: missing X.509 validation (FTP with TLS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-002 Product: FTP Rush Vendor: Wing FTP Software Affected Versions: v2.1.8 Tested Versions: v2.1.8 Windows 7 32 bit and Windows 8.1 64 bit Vulnerability Type: X.509 validation Risk Level: Medium Solution Status: Vendor...