New Year Greeting Cards - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application New Year Greeting Cards published at the 'play' market has multiple vulnerabilities...

Happy New Year 2016 - Base64 encoded String, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Happy New Year 2016 published at the 'play' market has multiple vulnerabilities...

New Year Stickers - 2016 Cards - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application New Year Stickers - 2016 Cards published at the 'play' market has multiple vulnerabilities...

完全無料!!スラムダンクの続き(まとめサイト)新着370話 - External URLs, SQLite database found, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application 完全無料!!スラムダンクの続きまとめサイト新着370話 published at the 'play' market has multiple vulnerabilities...

NEW TENVIS - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application NEW TENVIS published at the 'play' market has multiple vulnerabilities...

New York City Night & Day Free - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application New York City Night & Day Free published at the 'play' market has multiple vulnerabilities...

New Relic: rpm.newrelic.com - monitor creation to other accounts

It is possible to create monitors for other users by changing the user id in the body of the post request when creating a new monitor. Even though my tests were unsuccessful in a XSS on the monitor information, it may be an attack vector to other vulnerabilities since the monitor information show...

Apple, Google Faced All Writs Act Orders

The American Civil Liberties Union has dug up more proof that from the get-go the FBI’s attempt to crack open an iPhone used by the San Bernardino shooter Syed Rizwan Farook was not just about the one phone. The ACLU found court documents and on Wednesday published an interactive map visualizing...

New Relic: CSV Injection in sub_accounts.csv

As an admin of a company, I can set my company name to be something like "=1+1", which, when downloaded by me or anyone else with permission to access that file, will execute and show "2" in the excel file. While this may seem safe, I am able to make the name something more malicious, such as...

Medium: tomcat6

Issue Overview: A directory traversal vulnerability in RequestUtil.java was discovered which allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application in a getResource,...

The 7 Most Wanted Iranian Hackers By the FBI

The Federal Bureau of Investigation FBI has lengthened its Most Wanted List by adding seven Iranian hackers who are accused of attacking a range of US banks and a New York dam. On Thursday, the United States Department of Justice DoJ charged seven Iranian hackers with a slew of computer hacking...

Iranians Indicted Over DDoS Campaign on Banks, Dam Hack

The U.S. government on Thursday indicted seven hackers affiliated with the Iranian government for attacks it called “a frightening new frontier in cybercrime.” Accusing the men of carrying out a series of distributed denial of service DDoS attacks against 46 financial companies, the Department of...

Siemens APOGEE Insight Incorrect File Permissions Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-082-01 Siemens APOGEE Insight Incorrect File Permissions Vulnerability that was published March 22, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 3 -------- Siemens has identified an...

New Relic: Stored XSS through Angular Expression Sandbox Escape

As an Admin of an account, I am able to set the Name of the Account to an Angular expression. This Angular expressions is resolved and executed on the Insights Welcome Page for anyone that is apart of the Account. Due to the ability to invite anyone even current NewRelic users to an Account, it...

Failback That Was Canceled or Failed Results in CID Mismatch

Challenge In rare situations, if a VMware Replication Failback to Original VM fails or is canceled, the original VM may be left in a 'consolidation needed' state and cannot be powered on or consolidated because of errors such as: The parent virtual disk has been modified since the child was creat...

DbDat - Db Database Assessment Tool

DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...

New Relic: Synthetics Xss

Hello New Relic Team , i have just found that i can add html code and it will be executed . the issue in https://synthetics.newrelic.com if you added a new monitor with the html code , for example " when you go to https://synthetics.newrelic.com/accounts/"accountnumber"/synthetics and search for ...

New Relic: Host Header Injection / Cache Poisoning

The application reflects HTTP Header value back in it's response and it may be possible to poison the server cache. The X-Forwarded-Host is directly reflected as a hyperlink. HTTP Request GET / HTTP/1.1 Host: newrelic.com X-Forwarded-Host: pavanw3b.com ... .... HTTP Response HTTP/1.1 200 OK...

Uses insecure CSPRNG (openssl_random_pseudo_bytes())

It's not fork safe In most versions of PHP, it lies about being secure And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: Release a new version v1.3.0 or most likely v2.0.0 that doesn't rely...

New Relic: Normal user can set "Job title" of other users by Direct Object Reference

A normal user when logs in to "New Relic" and navigates to the "Account Settings" page, can only set his/her own Job title. All other user's Job title selection are not available. But using a proxy tool like Burp Suite, while changing his own job role, if he replaces his own ID with any other use...