Google Play Cracks Down on Malicious Apps

Google Play is ramping up its offensive against malicious apps, which have continued to plague the official app store for Android devices over the years. In a Wednesday post, Andrew Ahn, product manager at Google Play, said that the number of app submissions that were rejected on the app...

CVE-2019-6537

Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An...

CVE-2018-15658

An issue was discovered in 42Gears SureMDM before 2018-11-27. By visiting the page found at /console/ConsolePage/Master.html, an attacker is able to see the markup that would be presented to an authenticated user. This is caused by the session validation occurring after the initial markup is...

Joomla WebMapPlus 1.0 SQL Injection

Exploit Title : Joomla WebMapPlus Components 1.0 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/02/2019 Vendor Homepage : artio.net Software Download Link : github.com/bkulyk/webmapplus.git Software Information Link : github.com/bkulyk/webmappl...

Joomla K2 2.9.0 Database Disclosure / SQL Injection

Exploit Title : Joomla K2 Components 2.9.0 SQL Injection / Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 04/02/2019 Vendor Homepage : getk2.org Software Download Link : getk2.org/downloads/?f=K2v2.9.0.zip Software Information Link :...

Houzz Urges Password Resets After Data Breach

Interior decorating website Houzz on Friday issued a notice that user data – including usernames, passwords and IP addresses – had been accessed by an “unauthorized third party.” Houzz connects consumers to varying home-goods departments or professionals for purchasing furniture. The Palo Alto,...

ZoneMinder cross-site scripting vulnerability (CNVD-2019-04696)

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras and more. A cross-site scripting vulnerability exists in the web/skins/classic/views/plugin.php file in ZoneMinder version 1.32.3, which can be exploited by a remote attacker with the...

Lapis Reviews plugin has xss vulnerability

Lai Bili Comments Plugin is a comment management plugin that uses social networking site accounts to log in, eliminating the registration process and increasing users' willingness to engage and communicate. An xss vulnerability exists in Lai Bili Comment Plugin, which can be exploited by attacker...

The vulnerability of the SAP Business Warehouse universal data integration platform, related to incorrect processing of data provided by users, allows a perpetrator to implant arbitrary codes.

The vulnerability of the SAP Business Warehouse Universal Data Integration platform is related to the improper processing of data provided by users. Exploiting this vulnerability allows a malicious actor to inject arbitrary code remotely...

Securing Social / Locking Login / Armoring Authentication

Authentication might be the single biggest hazard for web security over the next decade. It's not that the fundamentals of authentication are particularly challenging; we've understood the basic principles behind password management, push-based authorization, and device certificates for some time...

Google Fined $57M in Largest GDPR Slap Yet

France’s National Data Protection Commission CNIL has fined Google $57 million €50 million for violations of the General Data Protection Regulation GDPR – the largest fine yet issued under the EU’s new data privacy law. In investigating group complaints from privacy advocacy groups None Of Your...

MailEnable Path Traversal Vulnerability

MailEnable is a suite of POP3 and SMTP mail servers from MailEnable Australia. A directory traversal vulnerability exists in MailEnable versions prior to 8.60, which stems from the program incorrectly handling '/... /' and '/... /' sequences. An attacker could exploit this vulnerability to read...

Improper Authorization

Overview Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. Thi...

Pre-Installed Android App Impacts Millions with Slew of Malicious Activity

A pre-installed Android application on Alcatel smartphones has been found surreptitiously siphoning off geolocation data, email addresses and phone identification numbers and sending the data to a server in China. Analysts with Upstream’s Secure-D platform said that the app, Weather Forecast—Worl...

CVE-2019-6126

The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff...

Microsoft Office Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special...

CVE-2018-19505

Remedy AR System Server in BMC Remedy 7.1 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user, because userdata.js in the WOI:WorkOrderConsole component allows a username substitution involving a...

Horner Automation Cscape CSP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Horner Automation Cscape. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

Design/Logic Flaw

The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201N/m201N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a package name of android versionCode=19, versionName=4.4.2-20170213 that dynamically registers a broadcast receiver app component named...

CVE-2018-14985

The Leagoo Z5C Android device with a build fingerprint of sp7731c1h1032v4bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform app with a package name of com.android.settings versionCode=23, versionName=6.0-android.20170630.092853 that contains an exported...