Four New Normals for 2017

Let’s not talk about cybersecurity predictions for 2017. Let’s talk instead about new normals, things that have ceased to be novel because, well, they happen all the time and everywhere. Let’s concede that things such as greedy ransomware, imposing IOT botnets, high-profile bug bounties and...

Design/Logic Flaw

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This c...

Pushwoosh: Publicy accessible IDRAC instance at api-m.inapp.pushwoosh.com

Hi. I discovered a publicy accessible IDRAC instance at api-m.inapp.pushwoosh.com. I know this subdomain is out of scope, but still consider to report it. Since default credentials root/calvin not work, there are no security risks for now, but so far the instance is available to public, in the...

NordVPN - Fast & Secure VPN - Dangerous filesystem permissions, GPL license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application NordVPN - Fast & Secure VPN published at the 'play' market has multiple vulnerabilities...

Vulnerability is a combination punch--attack of distributed nodes-the vulnerability of early warning-the black bar safety net

Distributed systems mostly rely on the message queue middleware to solve the asynchronous processing, the application of coupled problems such as Message Queuing middleware of choice in turn depends on the overall system design and implementation, message packaging, transmission, processing throu...

Legal Robot: AWS hosting bucket for Legal Robots set as public browse and list contents: s3://legalrobot

Good day, I hope it treats you kindly : Legal Robot looks to use AWS hosting for your website. Description of issue: ===================== The Amazon Bucket s3://legalrobot has been configured to allow Public users access to browse all files on the server. This is a risk as described as it allows...

【Serious vulnerability】“iKuai”routing product vulnerabilities Advisory-a vulnerability warning-the black bar safety net

! L Recently, the national information security vulnerabilities library CNNVD received Beijing long-kiosk Science & Technology Co., Ltd. about enterprise-level stream routing product“iKuai IK-G20SQL injection vulnerability”, the“iKuai noobSQL injectionvulnerability”and“iKuai white command injecti...

BASHLITE Family Of Malware Infects 1 Million IoT Devices

More than one million consumer web-connected video cameras and DVRs are compromised by bot herders who use the devices for DDoS attacks, researchers say. According to Level 3 Threat Research Labs, a small malware family that goes by the names Lizkebab, BASHLITE, Torlus and Gafgyt is behind a web ...

Will Tiger router a large number of high-risk vulnerability analysis-vulnerability warning-the black bar safety net

Foreword This thing from a few months ago to start. There is one called Tao Sauvage foreigners happy to come to China to travel. Want to have a little China Souvenirs go back, preferably for a long time, select a section called The must Tiger the wireless router. ! Look at this ultra low price an...

Moneybird: Webhook allows sending payload using insecure HTTP protocol

Researcher noted that a non-secure HTTP endpoint is allowed in webhooks. We have decided to allow non-secure webhooks because too many API clients don't have HTTPS endpoints to receive our webhooks. We have added warnings to inform our clients what the security risks are, but cannot require HTTPS...

Symantec Mail Security for Domino Unsupported

The installation of Symantec Mail Security for Domino on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network Security, Inc...

TP-Link Loses Control Over Configuration Domain

Top router firm TP-Link has lost control of two key domains accessed by millions of consumers and small businesses each month. The domains, which are used to configure the company’s routers, have expired and been resold to domain name brokers who are actively seeking buyers. Security experts say...

Dropbox: XSS, Unvalidated redirects & phishing website hosting on dropbox servers

The report points out that Dropbox allows uploading and hosting HTML; this enables spam and phishing risks as well as XSS on dropboxusercontent.com. We continuously monitor our service for abusive use and take down such content; additionally, we are continuously improving our protections in this...

This App Lets You Find Anyone's Social Profile Just By Taking Their Photo

Is Google or Facebook evil? Forget it! Russian nerds have developed a new Face Recognition technology based app called FindFace, which is a nightmare for privacy lovers and human right advocates. FindFace is a terrifyingly powerful facial recognition app that lets you photograph strangers in a...

Outdated, Unpatched Software Rampant in Businesses

We all know outdated software, browsers, and plugins are unsafe, but how unsafe? Duo Labs has taken a hard look at the dangers of outdated software in a report released Tuesday that said 25 percent of business systems risk exposure to 700 possible vulnerabilities. The most insecure software, Duo...

The use of PHP 7 is due to the OPcache execute PHP code-bug warning-the black bar safety net

from:http://blog. gosecure. ca/2 0 1 6/0 4/2 7/binary-webshell-through-opcache-in-php-7/ In the PHP 7.0 release at the beginning, there are a lot of PHP developers for its performance improvement is very attention. In the introduction of OPcache, PHP performance has been greatly improved, many...

Free Tarot Reading - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Free Tarot Reading published at the 'play' market has multiple vulnerabilities...

Rollout or Not: the Benefits and Risks of iOS Remote Hot Patching

Previously On iOS Remote Hot Patching Apple’s detailed app review process has resulted in greater security for iOS apps made available through the App Store. However, this review process can be lengthy, which negatively impacts developers who need to quickly patch a buggy or insecure app. As a...

Puzzles Game For Kids: Mixed - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Puzzles Game For Kids: Mixed published at the 'play' market has multiple vulnerabilities...

Sea Plane: Flight Simulator 3D - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Sea Plane: Flight Simulator 3D published at the 'play' market has multiple vulnerabilities...