Malware infected Minecraft modpacks hit Google Play Store

By Deeba Ahmed According to researchers, Minecraft continues to attract the hacking community and a massive increase in infected, malware-laden Minecraft mods. This is a post from HackRead.com Read the original post: Malware infected Minecraft modpacks hit Google Play Store...

gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services

A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against local UPnP services including data exfiltration, data tempering, and other exploits. The highest threat from this vulnerability is to data confidentiality and...

gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services

A flaw was found in gupnp. DNS rebinding can occur when a victim's browser is used by a remote web server to trigger actions against local UPnP services including data exfiltration, data tempering, and other exploits. The highest threat from this vulnerability is to data confidentiality and...

Google to Let Android Users Opt-Out to Stop Ads From Tracking Them

Google is tightening its privacy practices that could make it harder for apps on Android phones and tablets to track users who have opted out of receiving personalized interest-based ads. The change will go into effect sometime in late 2021. The development, which mirrors Apple's move to enable...

‘Battle for the Galaxy’ Mobile Game Leaks 6M Gamer Profiles

An Elasticsearch server holding personal data of 6 million players of the popular mobile game Battle for the Galaxy was discovered insecure and containing over 1 terabyte of unencrypted data, meaning anyone with a link could access data stored on the repository. Ethical hackers WizCase found the...

USN-4970-1 gupnp vulnerability

It was discovered that GUPnP incorrectly filtered local requests. If a user were tricked into visiting a malicious website, a remote attacker could possibly use this issue to perform actions against local UPnP services such as obtaining or altering sensitive information...

DEBIAN-CVE-2021-33516

An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected...

23 Android Apps Expose Over 100,000,000 Users' Personal Data

Misconfigurations in multiple Android apps leaked sensitive data of more than 100 million users, potentially making them a lucrative target for malicious actors. "By not following best-practices when configuring and integrating third-party cloud-services into applications, millions of users'...

hostapd: UPnP SUBSCRIBE misbehavior in WPS AP

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue...

4 Major Privacy and Security Updates From Google You Should Know About

Google has announced a number of user-facing and under-the-hood changes in an attempt to boost privacy and security, including rolling out two-factor authentication automatically to all eligible users and bringing iOS-styled privacy labels to Android app listings. "Today we ask people who have...

How a Former Netflix Exec Built a Brazen Bribery Scheme

The company’s ex-vice president of IT faces 20 years in prison for creating a pay-to-play environment with technology vendors...

The vulnerability of the UPnP component of the D-Link DIR-816L network device’s microprogramming software allows a intruder to execute any command they desire.

The vulnerability of the Plug and Play UPnP component of the D-Link DIR-816L network device exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by entering useful payloads into the Search...

npupnp 访问控制错误漏洞

npupnp is an implementation library for the UPNP protocol. A DNS rebinding vulnerability exists in the embedded web server in versions prior to npupnp 4.1.4. An attacker can exploit this vulnerability to achieve remote code execution...

Minor update (3) for Vivaldi Android Browser 3.7

Head to the Google Play Store and download the browser. Alternatively, you can download Vivaldi from Uptodown, the Android app store. Your rating for our browser matters. ⭐️ ⭐️ ⭐️ ⭐️ ⭐️ Enjoy! Changelog The following is a list of changes since the second 3.7 stable, minor update : Backported patch...

Play Store apps plagued with malware have 700,000 downloads

By Deeba Ahmed Another day, another Android malware found in apps downloaded more than half a million times from Google Play Store. This is a post from HackRead.com Read the original post: Play Store apps plagued with malware have 700,000 downloads...

Over 750,000 Users Downloaded New Billing Fraud Apps From Google Play Store

Researchers have uncovered a new set of fraudulent Android apps in the Google Play store that were found to hijack SMS message notifications for carrying out billing fraud. The apps in question primarily targeted users in Southwest Asia and the Arabian Peninsula, attracting a total of 700,000...

D-Link DIR-802 Command Injection Vulnerability

The D-Link DIR-802 is a wireless router from AUO D-Link in Taiwan, China. A command injection vulnerability exists in the D-Link DIR-802 A1 1.00b05 and earlier versions, which stems from the system default of enabling Universal Plug and Play on port 1900. An attacker can exploit this vulnerabilit...

UPnP 数据伪造问题漏洞

UPnP is a Universal Plug and Play protocol from the Open Connectivity Foundation. A data forgery vulnerability exists in Portable SDK version 1.14.6 and later in UPnP Devices because it does not check the value of the "host" header...

[SECURITY] Fedora 32 Update: gnuchess-6.2.7-5.fc32

The gnuchess package contains the GNU chess program. By default, GNU chess uses a curses text-based interface. Alternatively, GNU chess can be used in conjunction with the xboard user interface and the X Window System for play using a graphical chess board. Install the gnuchess package if you wou...

The vulnerability of the myupnpmediasvr process allows a hacker to write arbitrary files or execute arbitrary commands on QNAP’s operating systems and network storage devices.

The vulnerability of the myupnpmediasvr process, which operates as a DLNA server for QTS operating systems and QNAP network storage devices, is related to insufficient protection of service data during UPNP requests. Exploiting this vulnerability allows a malicious actor to write arbitrary files ...