hi5 - Meet New People - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application hi5 - Meet New People published at the 'play' market has multiple vulnerabilities...

Siren Ringtones - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Siren Ringtones published at the 'play' market has multiple vulnerabilities...

Soothing sleep sounds - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Soothing sleep sounds published at the 'play' market has multiple vulnerabilities...

1 Second Everyday - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application 1 Second Everyday published at the 'play' market has multiple vulnerabilities...

RHE - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application RHE published at the 'play' market has multiple vulnerabilities...

Crazy About Startups - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Crazy About Startups published at the 'play' market has multiple vulnerabilities...

uShip - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application uShip published at the 'play' market has multiple vulnerabilities...

Zomato: Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration Flow

The zomato.com web application is vulnerable to authentication bypassing and sensitive information disclosure. The flaw exist in “Verify Email Address” link which is received in a mail after registration. Once the user enters Full Name, Email Address and Password during registration, he/she is...

VMware vRealize Automation Cross-Site Scripting Vulnerability

VMware vRealize Automation is a suite of cloud automation software from VMware. The software supports automated delivery of personalized infrastructure, deployment across multi-vendor, hybrid cloud infrastructures, simplified application release automation and continuous delivery. A cross-site...

Android Widevine Trusted Application Information Disclosure Vulnerability

Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA, and the Widevine Trusted Application is one of the components used to validate the Google DRM platform. A security vulnerability exists in Widevine Trusted Application in version 6.0.1 of...

Dream Gallery 1.0 SQL Injection

Dream Gallery 是国外一个相册程序，album.php 页面通过传入参数 id 的值来查看不同的专辑，由于没有对传入的 id 的值进行过滤，导致存在 SQL 注入，可获取数据名等。 分析 存在问题的文件位置： query "select from albuns order by albumname asc" -fetchAll; if $db-rows = 1 $albuns = $db-data; foreach $albuns as $album $a = object $album; $db-query "select from fotos where fotoalbu...

Secure Item Hub 1.0 XSS / Code Execution / File Upload

Document Title: =============== Secure Item Hub v1.0 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1682 Release Date: ============= 2016-01-27 Vulnerability Laboratory ID VL-ID: ==================================== 16...

Updated ruby-mail packages fix security vulnerability

The Mail library does not impose a length limit on email addresses, so an attacker can send a long spam message via a recipient address unless there is a limit on the application's side. The attacker-injected message in the recipient address is processed by the server. This type of vulnerability...

Serendipity 2.0.2 Cross Site Scripting

Information -------------------- Advisory by Netsparker Name: XSS Vulnerability in Serendipity Affected Software : Serendipity Affected Versions: v2.0.2 and possibly below Vendor Homepage : http://www.s9y.org Vulnerability Type : Cross-site Scripting Severity : Important Status : Fixed CVE-ID :...

SAP NetWeaver 7.4 XXE Injection Vulnerability

SAP NetWeaver version 7.4 suffers from an XML external entity injection vulnerability. Application: SAP NetWeaver Versions Affected: SAP NetWeaver 7.4, probably others Vendor URL: http://SAP.com Bugs: XML External Entity Send: 16.04.2015 Reported: 16.04.2015 Vendor response: 16.04.2015 Date of...

The vulnerability in the web application for data synchronization with ownCloud allows a hacker to gain access to protected information related to user accounts and cookies.

The vulnerability of a web application for data synchronization with ownCloud is related to the lack of protection for service-related data. Exploiting this vulnerability may allow an attacker, operating remotely, to gain access to protected information such as user accounts and cookies by readin...

Scientific Linux Security Update : nss, nss-util, and nspr on SL6.x, SL7.x i386/x86_64 (20151104)

A use-after-poison flaw and a heap-based buffer overflow flaw were found in the way NSS parsed certain ASN.1 structures. An attacker could use these flaws to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library...

Than the gourd baby is also scary Baidu full system APP SDK vulnerability - WormHole wormhole vulnerability analysis report-vulnerability warning-the black bar safety net

”You can’t have a back door in the software because you can’t have a back door that's only for the good guys.“ - Apple CEO Tim Cook ”You should not give software to install the back door because you can't guarantee that this Backdoor only the good guys can use.” – Apple CEO cook 0x00 sequence The...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system’s kernel is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially crafted application...

ITOP Reflective Cross-Site Scripting Vulnerability

ITOP is an open source web application . ITOP suffers from a reflected cross-site scripting vulnerability. Due to insufficient filtering of input passed to the "/pages/ajax.render.php" script via the "title" HTTP GET parameter, a remote, unauthenticated attacker could trick a logged-in user into...