Pirelli Home Broadband Routers Exposed for Two Years

ISP-issued home broadband routers have been a shooting gallery for researchers and hackers alike looking for, and successfully exploiting, shocking vulnerabilities. One disclosed by a researcher in Spain this week is symptomatic of the problem to a disturbing degree. Researcher Eduardo Novella...

Google Won't Patch WebView Prior to Android Jelly Bean

Hackers may have a perpetual shooting gallery of unpatched Android vulnerabilities at their disposal after it was disclosed today that Google no longer will provide WebView patches for older versions of its operating system. Researchers at Rapid7 have made mincemeat of WebView in Android Jelly...

Cool was traced to the presence of a backdoor threat to millions of users information security-vulnerability warning-the black bar safety net

Recently, security research firm PaloAlto Networks found that the domestic mobile phone manufacturers coolpad Android phone install the one named“CoolReaper”a backdoor program that may be related to more than 1, 0 0 0 million users of information security. ! Kupa was traced to the presence of a...

Mobile Carrier Controls Exploitable on a Massive Scale

LAS VEGAS – Device manufacturers and service providers quietly maintain a pervasive level of remote control over the devices they sell to consumers so they can push over-the-air OTA updates for a variety of reasons, but problematically one popular product that enables this type of control is poor...

Karsten Nohl Demonstrates SIM Card Root Attack At Black Hat

LAS VEGAS–Thanks to manufacturers employing old, weak encryption on SIM cards, researchers have found a way to root the cards and get access to billions of mobile devices. German security researcher Karsten Nohl of Security Research Labs demonstrated the SIM card attack in his talk at the Black H...

SIM Card Vulnerability Could Affect Millions of Cell Phones

As many as 750 million mobile phones could be vulnerable to an encryption flaw on certain types of SIM cards, a German cryptographer and researcher warned over the weekend. Karsten Nohl, the founder of Security Research Labs in Berlin, unveiled preliminary research on his blog behind the flaw in...

Google Android 2.3.5 - PowerVR SGX Driver Information Disclosure

// source: https://www.securityfocus.com/bid/57900/info The PowerVR SGX driver in Android is prone to an information-disclosure vulnerability. Successful exploits allows an attacker to gain access to sensitive information. Information obtained may aid in further attacks. Android 2.3.5 and prior...

Volez

Ability to modify a signed OTA recovery package due to an error in the signature verifier...

HP Quality Center缓存工作流脚本绕过安全限制漏洞

BUGTRAQ ID: 33854 CVECAN ID: CVE-2007-5289 HP质量中心可管理和控制质量流程，并在IT和应用环境中实现软件测试自动化。 HP质量中心的前端有一些嵌入到WEB浏览器中的COM组件组成。质量中心提供了自定义功能（被称为工作流），允许管理员修改默认的行为。这个工作流是由VBScript函数驱动的，每当客户端前端出现特定的事件时就会调用这些函数。...

Design/Logic Flaw

HP Mercury Quality Center QC 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture OTA API, as...

CVE-2007-5289

HP Mercury Quality Center QC 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture OTA API, as...

CVE-2007-5289

HP Quality Center (QC) 9.2 and earlier, and possibly TestDirector, caches client-side scripts for workflow logic. An attacker can modify (1) common.tds, (2) defects.tds, (3) manrun.tds, (4) req.tds, (5) testlab.tds, or (6) testplan.tds in %tmp%\TD_80, then set the file properties to read-only to ...

CVE-2007-5289

HP Mercury Quality Center QC 9.2 and earlier, and possibly TestDirector, relies on cached client-side scripts to implement "workflow" and decisions about the "capability" of a user, which allows remote attackers to execute arbitrary code via crafted use of the Open Test Architecture OTA API, as...