Disclosure of user actions through JavaScript with motion and orientation sensors — Mozilla

Security researcher Maryam Mehrnezhad of Newcastle University, UK reported an issue discovered by their research team, which also includes Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao. They found vulnerabilities in Firefox for Android using orientation data and motion sensors on a mobile...

VLC for Android beta - BSD license, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application VLC for Android beta published at the 'play' market has multiple vulnerabilities...

Lightweight themes on Firefox for Android do not verify a secure connection — Mozilla

Mozilla developer Margaret Leibovic reported when Firefox for Android installs lightweight themes, it does not check to verify that they are served over an HTTPS connection. Instead, themes can be installed over an unencrypted connection, which could allow for a man-in-the-middle MITM attack by...

FreeBSD : chromium -- multiple vulnerabilities (9d732078-32c7-11e5-b263-00262d5ed8ee)

Google Chrome Releases reports : 43 security fixes in this release, including : - 446032 High CVE-2015-1271: Heap-buffer-overflow in pdfium. Credit to cloudfuzzer. - 459215 High CVE-2015-1273: Heap-buffer-overflow in pdfium. Credit to makosoft. - 461858 High CVE-2015-1274: Settings allowed...

Viber for Android Remote Arbitrary Code Execution Vulnerability

Viber Media Viber for Android is a suite of VoIP and instant messaging software for the Android platform. A remote security vulnerability exists in Viber Media Viber for Android, which can be exploited by remote attackers to submit a special request to execute arbitrary code and take control of t...

Apache Cordova For Android Security Bypass Vulnerability

Apache Cordova is to build native mobile applications with HTML, CSS, JavaScript. A security bypass vulnerability exists in Apache Cordova For Android, which can be exploited by attackers to bypass certain security restrictions and perform unauthorized operations...

Viber for Android exposes insecure Javascript interface

------------------------------------------------------------------------ Viber for Android exposes insecure Javascript interface ------------------------------------------------------------------------ Yorick Koster, April 2014...

JVN#41281927: LINE vulnerable to script injection

LINE provided by LINE Corporation is an application used to communicate with others. LINE is vulnerable to MITM man-in-the-middle attacks since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM man-in-the-middle attacker. Impac...

Google Chrome for Android Cross Domain Bypass Vulnerability

Google Chrome for Android is an Android-based browser. Google Chrome for Android V8 bundles have cross-domain bypass that allows attackers to build malicious WEB pages, trick users into parsing and executing arbitrary code, etc...

Google Chrome for Android suffers from an unspecified vulnerability (CNVD-2015-00944)

Google Chrome for Android is an Android-based browser. An unspecified vulnerability in Google Chrome for Android allows attackers to construct malicious web pages that can be tricked into parsing by users, which can execute arbitrary code or crash the application...

SumaHo for Android fails to verify SSL/TLS server certificates

Overview SumaHo for Android fails to verify SSL/TLS server certificates. Hiroshi Kumagai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an...

Bump for Android vulnerable in handling of implicit intents

Overview Bump for Android is an application that allows users to share information and files. Bump for Android contains a vulnerability in the handling of implicit intents. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

JVN#08994136: Bump for Android vulnerable in handling of implicit intents

Bump for Android is an application that allows users to share information and files. Bump for Android contains a vulnerability in the handling of implicit intents. Impact Information such as the owner's name that was obtained from another device may be disclosed. Solution Do not use Bump for...

Ameba for Android contains an issue where it fails to verify SSL server certificates

Overview Ameba for Android contains an issue where it fails to verify SSL server certificates. Koki Takahashi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-minddle attack may allow an attacker...

Outlook.com for Android contains an issue where it fails to verify SSL server certificates

Overview Outlook.com for Android contains an issue where it fails to verify SSL server certificates. Koki Takahashi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-minddle attack may allow an...

PayPal for Android SSL证书校验安全漏洞

CVE ID:CVE-2013-7201 PayPal for Android是一款用于安卓的paypal支付应用。 PayPal for Android WebHybridClient类不正确校验服务器SSL证书，允许攻击者利用漏洞伪造HTTPS链接，进行中间人等攻击。 0 PayPal for Android 5.3 目前没有详细解决方案提供： https://play.google.com/store/apps/details?id=com.paypal.android.p2pmobile&hl=en...

Opera browser for Android issue in handling intent scheme URL's

Overview Opera browser for Android contains an issue in the handling of intent scheme URL's. Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact When a use...

FreeBSD : chromium -- multiple vulnerabilities (5acf4638-7e2c-11e3-9fba-00262d5ed8ee)

Google Chrome Releases reports : 11 security fixes in this release, including : - 249502 High CVE-2013-6646: Use-after-free in web workers. Credit to Collin Payne. - 326854 High CVE-2013-6641: Use-after-free related to forms. Credit to Atte Kettunen of OUSPG. - 324969 High CVE-2013-6642: Address...

[Secunia CSI 7.0] Next generation Patch Management Tool

Cybercrime costs organizations millions of dollars and to protect business from the consequences of security breaches, vulnerability intelligence and patch management are basic necessities in the toolbox of any IT team, as emphasized by organizations like the SANS Institute and the National...

Secunia CSI 7.0 - Next generation Patch Management tool released

Cybercrime costs organizations millions of dollars and to protect business from the consequences of security breaches, vulnerability intelligence and patch management are basic necessities in the toolbox of any IT team, as emphasized by organizations like the SANS Institute and the National...