Akamai NetSession 1.9.3.1 DLL Hijacking Vulnerability

Tempest Security Intelligence Advisory ADV-8/2016 - Akamai Netsession 1.9.3.1 is vulnerable to dll hijacking as it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned dll is missing from its installation. Thus making it possible to hijack...

VM Manager - Unsafe deleting, WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application VM Manager published at the 'play' market has multiple vulnerabilities...

Unija app - External URLs, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Unija app published at the 'play' market has multiple vulnerabilities...

Free Twitter Follower Coupon - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Free Twitter Follower Coupon published at the 'play' market has multiple vulnerabilities...

Recharge Express - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Recharge Express published at the 'play' market has multiple vulnerabilities...

Recharge XP - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Recharge XP published at the 'play' market has multiple vulnerabilities...

UTrade CFD Lite - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application UTrade CFD Lite published at the 'play' market has multiple vulnerabilities...

Nagios Core < 4.2.4 - Root Privilege Escalation (CVE-2016-9566)

INTRODUCTION ------------------------- Nagios Core daemon in versions below 4.2.4 was found to perform unsafe operations when handling the log file. This could be exploited by malicious local attackers to escalate their privileges from 'nagios' system user, or from a user belonging to 'nagios'...

Bilet.sakh.com Контроль - External URLs, Native code usage, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Bilet.sakh.com Контроль published at the 'play' market has multiple vulnerabilities...

Sakh.biz - Corrupted files, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Sakh.biz published at the 'play' market has multiple vulnerabilities...

Taxi.Sakh.com - External URLs, Unsafe deleting, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Taxi.Sakh.com published at the 'play' market has multiple vulnerabilities...

Jtbccms V1.0 'jtbc_cms_admin_manage_delete_filedisp()' function has a file deletion vulnerability

Jtbccms is a website system that can expand and clone existing modules. Jtbccms version 1.0 'jtbccmsadminmanagedeletefiledisp' function has a file deletion vulnerability. Due to receiving filepath variable to do iicstr function for adslashes filtering, the code conversion can be directly deleted ...

Propana Reload - Exported components, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Propana Reload published at the 'play' market has multiple vulnerabilities...

Symantec VIP Access Desktop Local Code Execution Vulnerability

Symantec VIP Access Desktop is a set of online account security protection software from Symantec Symantec. A local code execution vulnerability exists in Symantec VIP Access Desktop versions prior to 2.2.3, which arises from the program failing to filter user-submitted input. A local attacker...

DEBIAN-CVE-2016-6620

An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions prior to 4.6.4...

WordPress Google Analytics Counter Tracker 3.1.5 PHP Object Injection

------------------------------------------------------------------------ Google Analytics Counter Tracker WordPress Plugin unauthenticed PHP Object injection vulnerability ------------------------------------------------------------------------ Remco Vermeulen, July 2016...

DEBIAN-CVE-2016-6321

Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the filename parameter, aka POINTYFEATHER...

Remote Code Execution (RCE)

ua-parser is vulnerable to remote code execution RCE. This is due to the unsafe usage of yaml.load, which allows arbitrary script to be executed when a yaml file is loaded...

CVE-2016-9836

The file scanning mechanism of JFilterInput::isFileSafe in Joomla! CMS before 3.6.5 does not consider alternative PHP file extensions when checking uploaded files for PHP content, which enables a user to upload and execute files with the .php6, .php7, .phtml, and .phpt extensions. Additionally,...

Silk TV Remote - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Silk TV Remote published at the 'play' market has multiple vulnerabilities...