Facebook for Android - Information Diclosure Vulnerability

Title: Facebook for Android - Information Diclosure Vulnerability Affected Software: Facebook Application 1.8.1 for Android Confirmed on Android 2.2 Credit: Takeshi Terada Issue Status: v1.8.2 was released which fixes this vulnerability Overview: The LoginActivity of Facebook app has improper...

Chrome for Android - UXSS via com.android.browser.application_id Intent extra

CVE Number: CVE-2012-4905 Title: Chrome for Android - UXSS via com.android.browser.applicationid Intent extra Affected Software: Confirmed on Chrome for Android v18.0.1025123 Credit: Takeshi Terada Issue Status: v18.0.1025308 was released which fixes this vulnerability Overview: By sending a...

Facebook For Android Information Disclosure

Title: Facebook for Android - Information Diclosure Vulnerability Affected Software: Facebook Application 1.8.1 for Android Confirmed on Android 2.2 Credit: Takeshi Terada Issue Status: v1.8.2 was released which fixes this vulnerability Overview: The LoginActivity of Facebook app has improper...

Chrome For Android Universal Cross Site Scripting

CVE Number: CVE-2012-4905 Title: Chrome for Android - UXSS via com.android.browser.applicationid Intent extra Affected Software: Confirmed on Chrome for Android v18.0.1025123 Credit: Takeshi Terada Issue Status: v18.0.1025308 was released which fixes this vulnerability Overview: By sending a...

Hong Kong stock exchange Hacker sentenced for 9 Months Jail

Tse Man- lai, 28-year-old businessman, owner of an information technology company, launched denial-of-service DoS attacks on Hong Kong stock exchange last year on August 12 and 13 , was sentenced to nine months in jail on Friday. According to SCMP, Tse Man- lai, who had pleaded not guilty to two...

Calling Foul on the Political Football That is Do Not Track

It looks like it’s time for a do-over for DNT. The oft-maligned specification has become—like many other standards efforts before it—a political football. Parties with interests on both sides of the issue have their own agendas, cannot agree on semantics and ignore, in this case, what should be t...

CVE-2012-4905

Cross-site scripting XSS vulnerability in Google Chrome before 18.0.1025308 on Android allows remote attackers to inject arbitrary web script or HTML via an extra in an Intent object, aka "Universal XSS UXSS."...

CVE-2012-4905

The CVE-2012-4905 entry describes a UXSS (Universal XSS) flaw in Chrome for Android prior to 18.0.1025308. By sending a crafted Intent with javascript: URIs and by inserting Extra data (com.android.browser.application_id => com.android.chrome) into an Intent, an attacker could execute arbitrar...

CVE-2012-4905

Removed by vendor...

Google Updates Chrome for Android, Fixes Several Vulnerabilities

Google has issued a security update for its Chrome operating system on Android devices, resolving seven medium-risk vulnerabilities and paying out a total of $3,500 in rewards to two researchers. On the Google Chrome Blog, software engineer Jay Civelli wrote that the update strengthens Chrome for...

JVN#67435981: LINE for Android vulnerable in handling of implicit intents

LINE for Android provided by NHN Japan, is an application for communication with others. LINE for Android contains a vulnerability in the handling of implicit intents. Impact Information such as messages sent by LINE may be leaked to a third party through a malicious application. Solution Update...

cifs security update

CentOS Errata and Security Advisory CESA-2012:0902 An updated cifs-utils package that fixes one security issue, multiple bugs, and adds various enhancements is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A...

Pre-Owned Hardware

Counterfeit and “certified pre-owned” hardware is nothing new, but we think 2012 will see this issue morph from a sideshow in the cyber security world to center stage, with new revelations about contamination of the global supply chain by hardware and software components of dubious origin and...

SSL Certificate Fails to Adhere to Basic Constraints / Key Usage Extensions

An X.509 certificate sent by the remote host contains one or more violations of the restrictions imposed on it by RFC 5280. This means that either a root or intermediate Certificate Authority signed a certificate incorrectly. Certificates that fail to adhere to the restrictions in their extension...

TWSL2011-008: Focus Stealing Vulnerability in Android

Trustwave's SpiderLabs Security Advisory TWSL2011-008: Focus Stealing Vulnerability in Android https://www.trustwave.com/spiderlabs/advisories/TWSL2011-008.txt Published: 2011-08-06 Version: 1.0 Vendor: Google http://www.android.com/ Product: Android Versions affected: Tested on 2.1 - 2.3 Other...

Android Browser Cross-Application Scripting (CVE-2011-2357)

============================================================= Android Browser Cross-Application Scripting CVE-2011-2357 ============================================================= 1 Background -------------- Android applications are executed in a sandbox environment, to ensure that no applicati...

Week in Security: Scarily Tenacious Rootkits, Stuxnet's Secrets and Cisco Flaws

The news this week revolved around complex and troublesome threats, notably two rootkits, TDL4 and ZeroAccess. Stuxnet reared its head once again as did a new problem with Cisco’s popular videoconferencing software. Read on for the full week in review. In our most popular story of the week, we...

CVE-2010-0318

The replay functionality for ZFS Intent Log ZIL in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in opportunistic circumstances...

Design/Logic Flaw

The replay functionality for ZFS Intent Log ZIL in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in opportunistic circumstances...

CVE-2010-0318

The replay functionality for ZFS Intent Log ZIL in FreeBSD 7.1, 7.2, and 8.0, when creating files during replay of a setattr transaction, uses 7777 permissions instead of the original permissions, which might allow local users to read or modify unauthorized files in opportunistic circumstances...