ipa security update

CentOS Errata and Security Advisory CESA-2016:1797 An update for ipa is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Malvertising Campaign Pushing Neutrino Exploit Kit Shut Down

A global malvertising campaign exposing potentially one million users to the risk of being infected with CrypMIC ransomware delivered via the Neutrino Exploit Kit has been shut down, according to researchers. Cisco’s Talos Security Intelligence and Research Group, which discovered the criminal...

WhatsApp to Share Your Data with Facebook — You have 30 Days to Stop It

Nothing comes for Free, as "Free" is just a relative term used by companies to develop a strong user base and then use it for their own benefits. The same has been done by the secure messaging app WhatsApp, which has now made it crystal clear that the popular messaging service will begin sharing...

Best of Enterprise and AD Exploitation at Black Hat / DEFCON

Lots of hacks, lots of people, lots of content, and lots of parties. That basically sums up this years BlackHat and Defcon. The two conferences seem to get bigger every year with no sign of slowing down, which emphasizes how cybersecurity is becoming more and more of an issue for everyone:...

Verizon Set to Buy Yahoo for $5 Billion — Here's Why a Telecom is so Interested!

Finally, Someone has come forward to buy Yahoo! Guess Who? The telecommunication giant Verizon. Yes, Verizon Communications Inc. is reportedly closing in on a deal to acquire Yahoo’s core business for about $5 Billion, according to a report from Bloomberg. Since the agreement between the companie...

OLX: Stored XSS on contact name

Hi guys, I found a stored XSS in olx.pt. I didn't tested on other domains so feel free to update this report if other domains are also affected. When submiting a new ad, I added my XSS payload on dataperson. The ad got approved and no reflecting on this field. The output was sanitized. One thing...

The Web in conditions of competitive Race conditions）vulnerability-vulnerability warning-the black bar safety net

In order to improve developer and network security personnel on the conditions of the competitive attacks of vigilance,I wrote this blog. I think not many people know about this problem,to this end, I researched some of the points system is susceptible to conditions of competition to attack the C...

Researchers Tie Pirrit Adware to Israeli Marketing Company

Researchers have linked a variant of the Pirrit adware for Mac OS X to an Israeli online marketing company called TargetingEdge that is still in stealth mode. Amit Serper, lead Linux and Mac OS X researcher at Cybereason, said that script he wrote to remove the original version of Pirrit from...

HummingBad Android Malware Connected to YiSpecter iOS Attacks

The same group of cybercriminals behind a strain of iOS malware uncovered last year have apparently diversified and now dabble in Android malware. The group, dubbed Yingmob, has been running a malware campaign named HummingBad that controls 10 million Android devices globally and rakes in $300,00...

Chinese Ad Firm Infected 85 Million Android Users to Get More Clicks

An Android-based malware campaign has been found to control as many as 85 million Android devices globally and is making its gang an estimated $300,000 per month in fraudulent ad revenue. A Chinese advertising company called Yingmob is responsible for distributing the malware on a massive scale a...

Google Play Hit With Rash of Auto-Rooting Malware

Researchers have identified a recent wave of malware targeting the Google Play app marketplace that entices users to download utilities and games that when installed surreptitiously root devices. The exploit, which mobile security firm Lookout calls autorooting malware, gives attackers complete...

AD Picture Viewer Arbitrary Code Execution Vulnerability

AD Picture Viewer is a fast displaying picture viewer that allows users to organize graphic files with its file management features. An arbitrary code execution vulnerability exists in AD Picture Viewer. The software suffers from a memory corruption and buffer overflow when processing BMP images...

Mobile Triada and Horde Variants Bypass Android Security

Two mobile variants of Triada and Horde malware have been spotted in the wild by Check Point Software Technologies researchers who warn the latest samples have adopted dangerous new techniques including the ability to evade Google’s security on some OS versions. The Android Trojan called Triada,...

Pwned by Vpon

Vpon is one of many mobile ad SDKs marketed towards mainland Chinese and Taiwanese developers and app users. Recently, FireEye mobile security researchers identified a branch of Vpon ad SDK on iOS containing code that allows a malicious actor be it the app developer or the SDK creator to remotely...

CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability

Document Title: =============== CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1856 Release Date: ============= 2016-06-13 Vulnerability Laboratory ID VL-ID: ====================================...

CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability

Document Title: =============== CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1856 Release Date: ============= 2016-06-12 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress CM Ad Changer 1.7.7 Cross Site Scripting

Exploit Title: CM Ad Changer Plugin XSS Date: 9/6/2016 Exploit Author: Aaditya Purani Author Homepage: https://aadityapurani.com Vendor Homepage: https://ad-changer.cminds.com Software Link: https://downloads.wordpress.org/plugins/cm-ad-changer.zip Updated Version: 1.7.7 Tested on: Wordpress 4.5....

Samba 4.x < 4.1.23 / 4.2.x < 4.2.9 / 4.3.x < 4.3.6 / 4.4.x < 4.4.0rc4 Multiple Vulnerabilities

Binary data 9348.prm...

CM Ad Changer <= 1.7.7 - Stored Cross-Site Scripting (XSS)

An Stored Cross Site Scripting was reported by the author to CM Ad Plugins under which an unprivileged user can trigger a Stored XSS to perform malicious actions or any attacker could send a crafted link CSRF which can trigger the Stored XSS. PoC 1 Go to CM Ad changers - Campaigns 2 Create a...

CM Ad Changer <= 1.7.7 - Stored Cross-Site Scripting (XSS)

An Stored Cross Site Scripting was reported by the author to CM Ad Plugins under which an unprivileged user can trigger a Stored XSS to perform malicious actions or any attacker could send a crafted link CSRF which can trigger the Stored XSS. 1 Go to CM Ad changers - Campaigns 2 Create a Campaign...