CVE-2018-13864

A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 fixed in 2.6.16 when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests...

CVE-2018-13864

CVE-2018-13864: A directory traversal vulnerability affects Play Framework 2.6.12–2.6.15 (Windows). The Assets controller could be abused to download arbitrary files from the server via crafted HTTP requests. The issue is fixed in 2.6.16; upgrade to 2.6.16+ to remediate. No exploitation details a...

Directory Traversal

Play Assets Controller is affected by a path traversal vulnerability. The application incorrectly handles file paths, making it possible to access files on the classpath that are stored outside of the public folder. This vulnerability only affects the application running on Windows...

VulnCheck KEV: CVE-2012-5958

Stack-based buffer overflow in the uniqueservicename function in ssdp/ssdpserver.c in the SSDP parser in the portable SDK for UPnP Devices aka libupnp, formerly the Intel SDK for UPnP devices before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted...

Lenovo Help Android App Access Control - US

Lenovo Security Advisory: LEN-21561 Potential Impact: Exposure and modification of private app data Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2018-9067 Summary Description: The Lenovo Help Android app had insufficient access control for some functions which, if...

Lenovo Help Android App Access Control - Lenovo Support US

No description provided...

Grundig Smart Inter@ctive 3.0 Insecure Direct Object Reference

Exploit Title: Grundig Smart Remote App CSRF Google Dork: Local Vulnerability Date: 06.07.2018 Exploit Author: Ahmethan GALTEKAdegN @inject0r16 Vendor Homepage: https://www.grundig.com/ Software Link: https://play.google.com/store/apps/details?id=arcelik. android.grundig.remote Version: Grundig...

Microsoft Windows: Plug and Play device redirection (Remote Desktop Services)

This policy setting lets you control the redirection of supported Plug and Play and RemoteFX USB devices, such as Windows Portable Devices, to the remote computer in a Remote Desktop Services session. By default, Remote Desktop Services does not allow redirection of supported Plug and Play and...

Python-Based Adware Evolves to Install Malicious Browser Extensions

Security researchers have been warning of a few newly detected variants of python-based adware that are being distributed in the wild not only to inject ads but also found installing malicious browser extensions and hidden cryptocurrency miner into victims' computers. Dubbed PBot, or PythonBot, t...

Microsoft Windows: Prevent installation of devices also to already installed

This test checks the setting for policy OpenVAS Vulnerability Test $Id: windenydevicesalreadyinstalled.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Prevent installation of devices that match any of these device IDs: Also apply to matching devices that are already installed. Authors:...

Fortnite Fraudsters Infest the Web with Fake Apps, Scams

Fortnite, the sandbox video game, has become so popular that its maker, Epic Games, is ponying up $100 to $300 million to supply prize money for eSports tournaments. What it hasn’t ponied up for – at least not yet – is an Android version. Which means the bad guys are having a field day. We report...

Malicious App Infects 60,000 Android Devices – But Still Saves Their Batteries

UPDATE A battery-saving app that also allows attackers to snatch text messages and read sensitive log data has been downloaded by more than 60,000 Android devices so far. But what’s unique about the attack, according to the researchers at RiskIQ who discovered it, is that it holds true to its...

Malware infected Battery saver app on Play Store infects 60,000 users

By Waqas The IT security researchers at RiskIQ have discovered a unique malware This is a post from HackRead.com Read the original post: Malware infected Battery saver app on Play Store infects 60,000 users...

Google Solves Update Issue for Android Apps Installed from Unknown Sources

If you are wondering how to receive latest updates for an Android app—installed via a 3rd party source or peer-to-peer app sharing—directly from Google Play Store. For security reasons, until now apps installed from third-party sources cannot be updated automatically over-the-air, as Google does...

Google Solves Update Issue for Android Apps Installed from Unknown Sources

If you are wondering how to receive latest updates for an Android app—installed via a 3rd party source or peer-to-peer app sharing—directly from Google Play Store. For security reasons, until now apps installed from third-party sources cannot be updated automatically over-the-air, as Google does...

Fake Fortnite for Android links found on YouTube

The extremely popular video game Fortnite is coming to Android sometime this summer, and the fanbase is going wild. Not surprisingly, mobile malware developers are taking advantage. Already, there are several videos on YouTube with links claiming to be versions of Fortnite for Android, despite th...

Microsoft Windows: Service: Windows Media Player Network Sharing Service

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winmediaplayernetsharing.nasl 11344 2018-09-12 06:57:52Z emoss $ Check value for Windows Media Player Network Sharing Service WMPNetworkSvc Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

Mobile Menace Monday: A race to hidden ads

Who doesn’t love a good motorcycle racing game, right? How about one easily available on Google Play, a “safe” place for all your Android app desires? How about a bike racing game that sticks with you so much, you can’t easily uninstall it? And it displays hidden ads? Wait, what!? That’s right! I...

Russia asks Apple to remove Telegram Messenger from the App Store

Russia's communications regulator Roskomnadzor has threatened Apple to face the consequences if the company does not remove secure messaging app Telegram from its App Store. Back in April, the Russian government banned Telegram in the country for the company's refusal to hand over private...

RedDawn Espionage Campaign Shows Mobile APTs on the Rise

A sophisticated and targeted mobile espionage campaign has been found targeting North Korean defectors. Mounted by a relatively new APT actor known as Sun Team, the offensive used Google Play and Facebook as attack vectors; and overall, it shows how quickly the mobile threat landscape is evolving...