Most Smartphone Users Consider Privacy When Vetting Apps

Cellphone owners now account for 88 percent of the U.S. population, of which some 43 percent say they download applications on their phones. Among these ‘app users,’ 57 percent told the Pew Internet and American Life Project that they have either uninstalled existing applications or made the...

CVE-2012-4394: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter...

CVE-2012-4397: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...

CVE-2012-4390: Exposure of Sensitive Information to an Unauthorized Actor

1 apps/calendar/appinfo/remote.php and 2 apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors...

CVE-2012-1296: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the 1 title or 2 body parameter to admin/preview...

Half Million Chinese Android Devices got infected with SMSZombie

The amount of malware crafted and aimed at Android devices is ever-increasing. With Android being the most popular platform for smartphones and tablets around the world, Android users have become the low-hanging fruit when it comes to writing malware by the nefarious users. A new Android threat h...

SMSZombie Malware Infecting Android Devices, Stealing Money

A nasty new piece of malware that has the ability to steal money from users’ via fraudulent SMS payments has shown up in a Chinese Android market and researchers say it’s infected more than 500,000 victims. The SMSZombie malware is being hidden inside apps on the app market and once it’s on a...

mixi for Android information management vulnerability

Overview mixi for Android contains an issue which stores friends' comments on a SD card. mixi for Android provided by mixi, Inc. contains an issue which stores friends' comments on a SD card, therefore other applications can access this information directly from the SD card. Kazuhiko Kusano of...

Multiple GREE Android applications vulnerable in the WebView class

Overview Multiple Android applications provided by GREE contain a vulnerability in the WebView class. Multiple Android applications that use the SDK for HTML-based applications provided by GREE contain a vulnerability in the WebView class. Takeshi Terada of Mitsui Bussan Secure Directions, Inc.,...

FTC Finalizes Facebook Settlement over Privacy

The U.S. Federal Trade Commission today announced it had finalized its settlement with Facebook, which is now subject to biennial privacy audits for the next 20 years and requires its nearly 1 billion users opt in to any future privacy policy changes. The settlement announcement follows news that...

Sleipnir Mobile for Android vulnerable in the WebView class

Overview Sleipnir Mobile for Android contains a vulnerability in the WebView class. Sleipnir Mobile for Android is a web browser for Android devices. Sleipnir Mobile for Android contains a vulnerability in the WebView class. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this...

OpenJDK: unrestricted use of TimeZone.setDefault() (i18n, 7110687)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.235 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality,...

CVE-2012-1861

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Script i...

CVE-2012-1859

Cross-site scripting XSS vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka...

Cross site scripting

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Script i...

CVE-2012-1861

CVE-2012-1861 is an XSS vulnerability in Microsoft SharePoint 2010 (Gold/SP1), SharePoint Foundation 2010 (Gold/SP1), and Office Web Apps 2010 (Gold/SP1) where attacker-controlled JavaScript in a URL can execute in the user’s browser. Public sources (OpenVAS/Nessus/Tenable entry MS12-050) referen...

CVE-2012-1860

CVE-2012-1860 affects Microsoft SharePoint components: SharePoint Server 2007 (SP2/SP3), SharePoint Server 2010 (Gold/SP1), and Office Web Apps 2010 (Gold/SP1). The root cause is improper permission checks for search scopes, enabling remote authenticated users to view or tamper with other users’ ...

CVE-2012-1859

Cross-site scripting XSS vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka...

CVE-2012-1861: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Script i...

CVE-2012-1860: Undefined Security Weakness

Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service data modificati...