AppLock Theme Aurora - Exported components vulnerabilities

HackApp vulnerability scanner discovered that application AppLock Theme Aurora published at the 'play' market has multiple vulnerabilities...

IBM WebSphere Commerce Open Redirection Vulnerability

IBM WebSphere Commerce is a suite of e-commerce solutions. The solution supports all sales business models, including B2C, B2B, and B2B2C, on a single customer interaction platform.Aurora starter store is one of the page layout tools. An open redirection vulnerability exists in the Aurora starter...

CVE-2013-6124

The Qualcomm Innovation Center QuIC init scripts in Code Aurora Forum CAF releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a 1 chown or 2 chmod command, as demonstrated by changing the permissions of an arbitrary file via...

Code injection

A certain Qualcomm Innovation Center QuIC patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum CAF releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption...

Command injection

The Qualcomm Innovation Center QuIC init scripts in Code Aurora Forum CAF releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a 1 chown or 2 chmod command, as demonstrated by changing the permissions of an arbitrary file via...

CVE-2013-2599

A certain Qualcomm Innovation Center QuIC patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum CAF releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption...

CVE-2013-6124

The Qualcomm Innovation Center QuIC init scripts in Code Aurora Forum CAF releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a 1 chown or 2 chmod command, as demonstrated by changing the permissions of an arbitrary file via...

DHS Releases Hundreds of Documents on Wrong Project Aurora

In response to a Freedom of Information Act request for information about the Operation Aurora attack on Google and other organizations in 2009 the Department of Homeland Security released hundreds of pages of documents related not to that attack campaign, but to the Aurora project run at Idaho...

Internet Explorer "Aurora" Memory Corruption

No description provided by source. $Id: ms10002aurora.rb 9787 2010-07-12 02:51:50Z egypt $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of us...

Code Aurora多个产品'CONFIG_STRICT_MEMORY_RWX'安全限制绕过漏洞

BUGTRAQ ID: 65630 CVECAN ID: CVE-2013-4737 Code Aurora Forum是Linux基金会协同项目。 Code Aurora多个项目的CONFIGSTRICTMEMORYRWX功能没有正确考虑某些内存区段，在实现中存在安全漏洞，这可使远程攻击者通过固定位置的RWX内存，利用此漏洞绕过目标访问限制。 0 Code Aurora QRD Android Code Aurora Firefox OS for MSM Code Aurora Android for MSM 厂商补丁： Code Aurora -----------...

Chinese hackers who breached Google in 2010 gained access to thousands of surveillance orders

In 2010, as part of what has been dubbed as Operation Aurora, Chinese hackers infiltrated a special database within Google's systems and gained access to a sensitive database worth of information about American surveillance targets. Google reported the hack publicly years ago, saying that the...

Chinese hackers who breached Google in 2010 gained access to thousands of surveillance orders

In 2010, as part of what has been dubbed as Operation Aurora, Chinese hackers infiltrated a special database within Google’s systems and gained access to a sensitive database worth of information about American surveillance targets. Google reported the hack publicly years ago, saying that the...

Netcraft.com Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Advisory: www.netcraft.com - Search Form Cross-site Scripting vulnerability Advisory ID: SSCHADV2013-008 Author: Stefan Schurtz Affected Software: Successfully tested on www.netcraft.com Vendor URL: http://www.netcraft.com Vendor Status: fixed...

APT1-Themed Spear Phishing Campaign Linked to China

Researchers at Seculert have discovered a link between spear phishing campaigns targeting Japanese and Chinese journalists, post-Mandiant’s APT1 report, and domains connected to the Aurora attacks on Google and the Shady RAT campaign. In particular, in the attacks against the Japanese, the malwar...

Out-of-Band IE Patch Released as More Sites Attacked

Internet Explorer users, exposed to a zero-day vulnerability in the browser and a faulty temporary Fix It from Microsoft, finally got some relief today when the company, as promised, released an out-of-band patch. Meanwhile, a handful of new telco, manufacturing and human rights sites have been...

Chinese Hackers exploiting Internet Explorer Zero Day vulnerability for Cyber Espionage

Web site for the Council on Foreign Relations was compromised and recently hit by a drive-by attack that was detected earlier this week. Hacker are suspected to be from China , who are exploiting a zero day Internet Explorer vulnerability for Cyber Espionage attack against one of American most...

Qualcomm Patches Privilege Escalation, DoS Vulnerabilities in Android Devices

Qualcomm has patched a handful of vulnerabilities in its devices that if exploited could leave Android OS kernels open to privilege escalation or denial of service DoS attacks. According to notes published earlier today by Michael Orlando, a vulnerability analyst at the United States Computer...

Large-Scale Water Holing Attack Campaigns Hitting Key Targets

A new APT-style espionage campaign launched this summer targeting organizations tied to financial services, government agencies and the defense industry used a technique dubbed water holing to entice victims and silently redirect them to sites hosting zero-day exploits. Researchers at RSA Securit...

Operation Aurora - Other Zero-Day Attacks targeting finance and Energy

The infamous Aurora Trojan horse is just one of many attacks launched by the same group of malware authors over the past three years, according to researchers at Symantec. Security researchers with Symantec have issued a report outlining the techniques used by the so-called "Edgewood" hacking...

'Elderwood' Crew, Tied to Google Aurora Attack, Targeting Defense, Energy, Finance Companies

UPDATE–The same team that attacked Google in the Aurora campaign in 2009 is still active and has been conducting a long-term campaign targeting defense contractors, financial services companies, energy companies, human rights organizations and government agencies using a seemingly inexhaustible...