Android Browser RCE Through Google Play Store XFO

This module combines two vulnerabilities to achieve remote code execution on affected Android devices. First, the module exploits CVE-2014-6041, a Universal Cross-Site Scripting UXSS vulnerability present in versions of Android's open source stock browser the AOSP Browser prior to 4.4. Second, th...

Adware Android Apps Found in Google Play With Millions of Downloads

With the rise in mobile market, last year we have seen sharp growth in malicious 'adware' — the most prevalent mobile threat in the world. And now, security researchers have once again found Google Play Store offering malicious apps that are infecting millions of Android users with adware. It’s n...

Google Offers Bug Bounty Vulnerability Research Grants

Google last week announced that it has instituted a program for 2015 in which researchers can receive up to 3,133.70 in grant money for bug hunting. Researchers must apply for the grants, which will be an up-front award that will be paid out before a bug is submitted, Google said. “Researchers’...

I-O DATA DEVICE NP-BBRM Denial of Service Vulnerability

The I-O DATA DEVICE NP-BBRM is a router product from I-O DATA DEVICE Japan. A security vulnerability exists in the I-O DATA DEVICE NP-BBRM router. A remote attacker can exploit this vulnerability by sending UPnP requests to cause a denial of service SSDP reflection...

Google Engineer Explains Company's Decision Not to Patch Bug in Older Android Versions

Google has taken quite a bit of heat in recent weeks for its decision not to patch a vulnerability in the WebView component of Android in older versions, leaving hundreds of millions of users exposed to potential attacks. Now, a Google engineer is explaining the company’s reasoning, saying that...

NP-BBRM vulnerable in UPnP functionality

Overview NP-BBRM provided by I-O DATA DEVICE, INC. is a LAN router. NP-BBRM contains a vulnerability in the UPnP functionality. Impact The device may be used in a DDoS attack, as a SSDP reflector. Solution Disable UPnP Disable UPnP functionality from the management configuration in the settings...

GCHQ Releases 'Cryptoy' App for Kids to Teach Encryption

British government surveillance agency GCHQ – counterpart of NSA – has fired-up another debate over the Internet by launching Android application to encourage teenagers to tackle emerging cybersecurity threats. The newly launched Android app, dubbed "Cryptoy", was developed by STEM science,...

Android Malware Installs Pirated Assassin's Creed App

A pirated version of the Assassin’s Creed application for Android is bundled with malware according to the security-as-as-service from Zscaler. Assassin’s Creed is a popular, open-world series of adventure games available in various iterations on the XBOX, PlayStation, PC and other gaming...

CVE-2014-4880

Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header...

CVE-2014-4880

CVE-2014-4880 describes a buffer overflow in Hikvision DVR RTSP handling that enables remote code execution. The NVD entry notes a vulnerability in Hikvision DVR DS-7204 firmware (2.2.10 build 131009) and other models, exploitable via a long RTSP PLAY request with an oversized Authorization heade...

CVE-2014-4880

Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary code via an RTSP PLAY request with a long Authorization header...

[SECURITY] Fedora 20 Update: deluge-1.3.10-1.fc20

Deluge is a new BitTorrent client, created using Python and GTK+. It is intended to bring a native, full-featured client to Linux GTK+ desktop environments such as GNOME and XFCE. It supports features such as DHT Distributed Hash Tables, PEX =C2=B5Torrent-compatible Peer Exchange, an d UPnP...

CVE-2014-6980

The LINE PLAY aka jp.naver.lineplay.android application 2.3.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The LINE PLAY aka jp.naver.lineplay.android application 2.3.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6980

The LINE PLAY aka jp.naver.lineplay.android application 2.3.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6980

The CVE-2014-6980 entry concerns the LINE PLAY Android app (version 2.3.1.1). The vulnerability is an inability to verify X.509 SSL certificates, enabling MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. According to NVD data, the impact is PARTIAL confi...

X (Formerly Twitter): Stored xss

Hi! There's a stored xss on ads.twitter.com under "Add New App" section at https://ads.twitter.com/accounts/18ce53wsl3g/campaigns/newobjective/appinstalls. There's a option to add android application by Google play app id, so i searched for a app on play store with name " "" " and then i got this...

Android App SSL Certificate Validation Errors Enumerated

A growing compilation of close to 350 Android applications that fail to perform SSL certificate validation over HTTPS has been put together by the CERT Coordination Center at the Software Engineering Institute at Carnegie Mellon University. Researcher Will Dormann created a large spreadsheet host...

SandroRAT — Android Malware that Disguises itself as "Kaspersky Mobile Security" App

Researchers have warned users of Android devices to avoid app downloads from particularly unauthorized sources, since a new and sophisticated piece of malware is targeting Android users through phishing emails. The malware, dubbed SandroRAT, is currently being used by cybercriminals to target...

id Software Quake 3 Arena Server 1.29 Possible Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3123/info Quake3 Arena Server is a software package designed to host multiple Quake 3 players over a network for interactive play. A vulnerability exists in this software that can allow a malicious user to remotely crash ...