Researchers Tie Pirrit Adware to Israeli Marketing Company

Researchers have linked a variant of the Pirrit adware for Mac OS X to an Israeli online marketing company called TargetingEdge that is still in stealth mode. Amit Serper, lead Linux and Mac OS X researcher at Cybereason, said that script he wrote to remove the original version of Pirrit from...

HummingBad Android Malware Connected to YiSpecter iOS Attacks

The same group of cybercriminals behind a strain of iOS malware uncovered last year have apparently diversified and now dabble in Android malware. The group, dubbed Yingmob, has been running a malware campaign named HummingBad that controls 10 million Android devices globally and rakes in $300,00...

Chinese Ad Firm Infected 85 Million Android Users to Get More Clicks

An Android-based malware campaign has been found to control as many as 85 million Android devices globally and is making its gang an estimated $300,000 per month in fraudulent ad revenue. A Chinese advertising company called Yingmob is responsible for distributing the malware on a massive scale a...

Google Play Hit With Rash of Auto-Rooting Malware

Researchers have identified a recent wave of malware targeting the Google Play app marketplace that entices users to download utilities and games that when installed surreptitiously root devices. The exploit, which mobile security firm Lookout calls autorooting malware, gives attackers complete...

AD Picture Viewer Arbitrary Code Execution Vulnerability

AD Picture Viewer is a fast displaying picture viewer that allows users to organize graphic files with its file management features. An arbitrary code execution vulnerability exists in AD Picture Viewer. The software suffers from a memory corruption and buffer overflow when processing BMP images...

Mobile Triada and Horde Variants Bypass Android Security

Two mobile variants of Triada and Horde malware have been spotted in the wild by Check Point Software Technologies researchers who warn the latest samples have adopted dangerous new techniques including the ability to evade Google’s security on some OS versions. The Android Trojan called Triada,...

Pwned by Vpon

Vpon is one of many mobile ad SDKs marketed towards mainland Chinese and Taiwanese developers and app users. Recently, FireEye mobile security researchers identified a branch of Vpon ad SDK on iOS containing code that allows a malicious actor be it the app developer or the SDK creator to remotely...

CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability

Document Title: =============== CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1856 Release Date: ============= 2016-06-13 Vulnerability Laboratory ID VL-ID: ====================================...

CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability

Document Title: =============== CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1856 Release Date: ============= 2016-06-12 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress CM Ad Changer 1.7.7 Cross Site Scripting

Exploit Title: CM Ad Changer Plugin XSS Date: 9/6/2016 Exploit Author: Aaditya Purani Author Homepage: https://aadityapurani.com Vendor Homepage: https://ad-changer.cminds.com Software Link: https://downloads.wordpress.org/plugins/cm-ad-changer.zip Updated Version: 1.7.7 Tested on: Wordpress 4.5....

Samba 4.x < 4.1.23 / 4.2.x < 4.2.9 / 4.3.x < 4.3.6 / 4.4.x < 4.4.0rc4 Multiple Vulnerabilities

Binary data 9348.prm...

CM Ad Changer <= 1.7.7 - Stored Cross-Site Scripting (XSS)

An Stored Cross Site Scripting was reported by the author to CM Ad Plugins under which an unprivileged user can trigger a Stored XSS to perform malicious actions or any attacker could send a crafted link CSRF which can trigger the Stored XSS. 1 Go to CM Ad changers - Campaigns 2 Create a Campaign...

CM Ad Changer <= 1.7.7 - Stored Cross-Site Scripting (XSS)

An Stored Cross Site Scripting was reported by the author to CM Ad Plugins under which an unprivileged user can trigger a Stored XSS to perform malicious actions or any attacker could send a crafted link CSRF which can trigger the Stored XSS. PoC 1 Go to CM Ad changers - Campaigns 2 Create a...

Multiple vulnerabilities in HPE LoadRunner and Performance Center (CNVD-2016-03838)

HPE LoadRunner and Performance Center are performance load testing software from Hewlett-Packard USA. Multiple vulnerabilities in HPE LoadRunner and HPE Performance Center allow remote attackers to conduct denial-of-service attacks by submitting ad hoc requests...

Multiple vulnerabilities in HPE LoadRunner and Performance Center (CNVD-2016-03840)

HPE LoadRunner and Performance Center are performance load testing software from Hewlett-Packard USA. Multiple vulnerabilities in HPE LoadRunner and HPE Performance Center allow remote attackers to conduct denial-of-service attacks by submitting ad hoc requests...

天融信TopApp-AD /acc/vpn/download.php 下载漏洞

No description provided by source...

天融信TopApp-AD /acc/network/redial_pppoe.php等多处命令执行漏洞

No description provided by source...

Facebook Ads now Tracks you, Even if you don't have an Account

There's nowhere to hide across the web, especially from the marketing and advertising companies. If you are paranoid about your privacy, you may get upset to know that Facebook will now track and deliver targeted Ads on other apps and websites for everyone, even if you do not have Facebook...

Network Wide Hardware Ad Blocking: Pi-Hole

The Pi-hole can block ads for all devices on your network. All you need is a Raspberry Pi connected to your router. It was inspired as a low-cost,open source alternative to the AdTrap. The Pi-hole works on the the B, B+and Pi 2 it can also run on the Zero, but you need a micro-USB-to-Ethernet...

CVE-2016-1402

CVE-2016-1402 describes a denial-of-service vulnerability in the Active Directory integration component of Cisco Identity Services Engine (ISE) for versions prior to 1.2.0.899 patch 7, when AD group-membership authorization is enabled. A remote attacker can trigger an outage by sending a crafted ...