Bug in Android ADB Backup System Can Allow Injection of Malicious Apps

There’s a severe vulnerability in the way that all versions of Android handle the restoration of backups that can allow an attacker to inject a malicious APK file into the backup archive. The bug is the result of an issue with the ADB command-line tool for Android and the researchers who discover...

Apple MAC OS X Code Signing Check Bypass Vulnerability

Apple Mac OS X is a commercial operating system. Apple Mac OS X code signing fails to verify libraries loaded outside of the application bundle, allowing attackers to exploit vulnerabilities to run malicious applications and bypass code signing...

Apple iOS Common Profile Application Installation Logic Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. There is a problem with the Apple iOS universal profile application installation logic, which allows an attacker to cause denial of service attacks ID collisions and launch interruptions by specially...

Apple MAC OS X Tampering with Application Checksum Bypass Vulnerability

Apple Mac OS X is a commercial operating system. The Apple Mac OS X Failure to Properly Verify Signature vulnerability allows attackers to bypass restrictions and launch tampered applications...

Internet Bug Bounty: Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)

Some of the sandbox logic of Flash Player can be circumvented on most web browsers by using special URL schemes. A website can deploy an SWF file via the data: or blob: URL schemes perhaps others. An app started in this way runs in the "local with files" or "local with networking" sandbox,...

Password Stealing Vulnerabilities Outlined in iOS, OSX

A group of researchers from Indiana University say that they’ve found a handful of vulnerabilities in both Apple’s OS X and iOS, and perhaps more worrisome, cracked the Keychain service that the company uses for apps and their sandboxes on OS X. A series of weak app-to-app authentication...

Apple Pushing Developers Toward HTTPS Connections in Apps

Apple is encouraging developers who create apps for iOS to begin moving their apps to an HTTPS-only model as soon as possible in an effort to thwart eavesdropping on insecure, plaintext HTTP connections. The move is yet one more sign that major Internet and technology companies are becoming ever...

OpenJDK: incorrect permissions check in resource loading (Beans, 8068320)

A flaw was discovered in the Beans component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions...

Mate7 TrustZone Exploit

The tzdriver and TEEOS modules of the Huawei Mate 7 have vulnerabilities which may allow malicious apps to perform denial of service attacks, or gain privileges, by gaining access to the TEE...

Win Free Air Miles for Finding Security Flaws in United Airlines

If you are a security researcher and fond of traveling from one conference to another, then United Airlines' bug bounty program would be of great interest for you. United Airlines has launched a new bug bounty program inviting security researchers and bug hunters to report vulnerabilities in its...

CVE-2015-1682

Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office for Mac 2011, Excel for Mac 2011, PowerPoint for Mac 2011, Wo...

MS15-046: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3057181)

The remote Windows host has a version of Microsoft Office, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, SharePoint Server, SharePoint Foundation Server, or Microsoft Office Web Apps installed that is affected by multiple remote code execution vulnerabilities due to improper handling of...

Microsoft Office Web Apps RCE Vulnerability (3057181)

This host is missing an important security update according to Microsoft Bulletin MS15-046. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

Datapp Sniffs Out Unencrypted Mobile Data

Last fall, researchers at the University of New Haven’s Cyber Forensics Research and Education Group dropped the hammer on a number of Android apps, including those from some popular social networking and dating sites, for their insistence on sending data in the clear. Pretty quickly, the UNHcFRE...

Xeams 4.5 Build 5755 - CSRF / XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple vulnerabilities in Xeams 4.5 Build 5755 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: email protected Vendor Homepage: http://www.synametrics.com Software Link:...

SynaMan 3.4 Build 1436 - CSRF / XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple vulnerabilities in SynaMan 3.4 Build 1436 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: email protected Vendor Homepage: http://www.synametrics.com Software Link:...

SynTail 1.5 Build 566 - CSRF / XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple vulnerabilities in SynTail 1.5 Build 566 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: email protected Vendor Homepage: http://www.synametrics.com Software Link:...

Syncrify Server <= 3.6 Build 833 - CSRF / XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: email protected Vendor Homepage: http://www.synametrics.com Software Link:...

Syncrify Server 3.6 Build 833 CSRF / Cross Site Scripting

Exploit Title: Multiple vulnerabilities in Syncrify Server 3.6 Build 833 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/SyncrifyDownload.htm Version: 3.6...

SynTail 1.5 Build 566 CSRF / Cross Site Scripting

Exploit Title: Multiple vulnerabilities in SynTail 1.5 Build 566 CSRF/Stored XSS Date: 07-05-2015 Exploit Author: Marlow Tannhauser Contact: [email protected] Vendor Homepage: http://www.synametrics.com Software Link: http://web.synametrics.com/SynTailDownload.htm Version: 1.5 Build 566...