Researchers Dump Trove of 0Days For Popular Android Applications

Researchers in China published a trove of information on previously unknown zero day vulnerabilities in popular applications for Google’s Android mobile operating system on Wednesday, including mobile browsers and at least one mobile wallet application. The vulnerabilities were found in a wide...

Mobile Based Wireless Network MiTM Attack Illustration

Mobile Based Wireless Network MiTM Attack Illustration Bilal Bokhari from zer0byte.com Illustrated perfect example of Mobile Based Wireless Network MiTM Attack on his blog. Bilal want to share this article with our Readers at THN, Have a look : If we look at the history of computer development, t...

APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001 OS X Lion v10.7.3 and Security Update 2012-001 is now available and addresses the following: Address Book Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2...

Mozilla Foundation Security Advisory 2012-04

Mozilla Foundation Security Advisory 2012-04 Title: Child nodes from nsDOMAttribute still accessible after removal of nodes Impact: Critical Announced: January 31, 2012 Reporter: regenrecht Products: Firefox, Thunderbird, SeaMonkey Fixed in: Firefox 10.0 Firefox 3.6.26 Thunderbird 10.0 Thunderbir...

HP Diagnostics Server 'magentservice.exe' Buffer Overflow Vulnerability

HP Diagnostics Server is prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ongoing Targeted Attack Campaign Going After Defense, Aerospace Industries

Researchers have identified a strain of malware that’s being used in a string of targeted attacks against defense contractors, government agencies and other organizations by leveraging exploits against zero-day vulnerabilities. The attacks may have been going on since 2009 in some form and the...

Potential Memory Corruption When Decoding Ogg Vorbis files — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative the possibility of memory corruption during the decoding of Ogg Vorbis files. This can cause a crash during decoding and has the potential for remote code execution...

Child nodes from nsDOMAttribute still accessible after removal of nodes — Mozilla

Security researcher regenrecht reported via TippingPoint's Zero Day Initiative that removed child nodes of nsDOMAttribute can be accessed under certain circumstances because of a premature notification of AttributeChildRemoved. This use-after-free of the child nodes could possibly allow for remot...

libtremor -- memory corruption

The Mozilla Project reports: Security researcher regenrecht reported via TippingPoint's Zero Day Initiative the possibility of memory corruption during the decoding of Ogg Vorbis files. This can cause a crash during decoding and has the potential for remote code execution...

Data Privacy Day 2012 – BYOD

January marks Data Privacy Month and on January 28th we celebrated Data Privacy Day. In the past year, we have seen an increase in the consumerization of IT and "Bring Your Own Device" BYOD in the enterprise. In honor of Data Privacy Day 2012, we have partnered with The Center for Identity at The...

ZDI-12-018 : Symantec PCAnywhere awhost32 Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-018 : Symantec PCAnywhere awhost32 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-018 January 25, 2012 - -- CVE ID: CVE-2011-3478 - -- CVSS: 9.7, AV:N/AC:L/Au:N/C:C/I:C/A:P - -- Affected Vendors: Symantec...

Google Fixes Serious Flaws in Chrome, Including Critical Safe Browsing Bug

Google has fixed several serious vulnerabilities in its Chrome browser, including a critical use-after-free flaw in the Safe Browsing navigation. The company paid out its highest bug bounty of $3133.70 for that bug. Among the other vulnerabilities Google fixed were four high-severity ones,...

Stoneware WebNetwork6 Multiple Vulnerabilities

Exploit for jsp platform in category web applications Stoneware WebNetwork6 Vulnerability Assessment Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud securit...

Stoneware WebNetwork6 Cross Site Request Forgery / Cross Site Scripting

Stoneware WebNetwork6 Vulnerability Assessment Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud security Stoneware INC. Discovered Zero Day vulnerabilities...

stoneware webnetwork6 - Multiple Vulnerabilities

stoneware webnetwork6 - Multiple Vulnerabilities Stoneware WebNetwork6 Vulnerability Assessment CVE-2012-0285 – XSS CVE-2012-0286 - CSRF Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork...

stoneware webnetwork6 - Multiple Vulnerabilities

Stoneware WebNetwork6 Vulnerability Assessment CVE-2012-0285 – XSS CVE-2012-0286 - CSRF Conducted by: Leland Public Schools Stoneware Customer Jacob Holcomb Network Engineer for LPS Conducted for: Leland Public Schools Purchaser of WebNetwork product. Test was to assure cloud security Stoneware...

Revamped Pwn2Own to Offer $105K in Prizes, Cash From Google for Chrome 0-Days

The Pwn2Own contest at the CanSecWest conference has become one of the landmark events on the calendar each year, as researchers gather with nervous vendors in a tiny room to see who can own which browser on which platform and how quickly. But this year’s contest will have a much different look...

Path traversal

Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter...

CVE-2012-0895

The CVE-2012-0895 issue affects the WordPress Count Per Day plugin; XSS vulnerability in map/map.php can be triggered via the map parameter and is present in versions before 3.1.1. Remediation: upgrade to version 3.1.1 or later. If upgrading is not possible, apply vendor advisories/workarounds fr...