New Ransomware Not Just Encrypts Your Android But Also Changes PIN Lock

DoubleLocker—as the name suggests, it locks device twice. Security researchers from Slovakia-based security software maker ESET have discovered a new Android ransomware that not just encrypts users’ data, but also locks them out of their devices by changing lock screen PIN. On top of that:...

Cisco IOS Software Plug-and-Play PKI API Certificate Validation Vulnerability

According to its self-reported version, the IOS is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

Cisco IOS XE Software Plug-and-Play PKI API Certificate Validation Vulnerability

According to its self-reported version, the Cisco IOS XE Software is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

Endless Frontier Saga – RPG Online - Certificates or keys found, Corrupted files, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Endless Frontier Saga – RPG Online published at the 'play' market has multiple vulnerabilities...

CVE-2017-12228

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient...

CVE-2017-12228

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient...

Design/Logic Flaw

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient...

CVE-2017-12228

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient...

Cisco IOS and IOS XE Network Plug and Play Certificate Validation Security Bypass Vulnerability

Cisco IOS and IOS XE are both operating systems developed by Cisco for its network devices.Network Plug and Play application is one of the network hot-plugging applications. A certificate validation security bypass vulnerability exists in the Network Plug and Play application in Cisco IOS version...

Cisco IOS and IOS XE Software Plug-and-Play PKI API Certificate Validation Vulnerability

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate...

playdoh.hasbro.com XSS vulnerability

Vulnerable URL: https://playdoh.hasbro.com/en-gb/video/Play-Doh-Animated-Short---Ant-Farm?playlistid=4702548390001=%3C/script%3E%22%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

A week in security (September 11 – September 17)

Last week, we dug into phishing campaigns done via Linkedin accounts, remediation versus prevention, issues with smart syringe pumps, and advised you to go patch against a Word 0day. We had some tips regarding identity theft protection, explored crowdsourced fraud, and explained YARA rules...

Yet Another Android Malware Infects Over 4.2 Million Google Play Store Users

Even after so many efforts by Google, malicious apps somehow managed to fool its Play Store's anti-malware protections and infect people with malicious software. The same happened once again when at least 50 apps managed to make its way onto Google Play Store and were successfully downloaded as...

Cross-site Scripting (XSS) Through URL Parameter

The Play Framework is vulnerable to cross-site scripting XSS. An XSS vulnerability has been found in Plays URL rendering. This vulnerability allows attackers to insert and execute arbitrary code...

Session Hijack

The Play Framework is vulnerable to a session magement vulnerablity. It is possible by a 3rd-party to acquire session information for another in-progress request for any application that uses the session in the processing of a 500 error page...

Cross-Site Scripting (XSS)

The Play Framework is vulnerable to cross-site scripting XSS. An XSS vulnerability has been found in the secure module login page, allowing attackers to inject and execute arbitrary code...

XML External Entities (XXE)

The Play Framework is vulnerable to XML external entities XXE injection. An attacker may use XML external entities to read files from the file system, internal network, or DoS the application...

Premium SMS Malware 'ExpensiveWall' Infects Millions of Android Devices

Google has ejected 50 apps from its Google Play store that were harboring mobile malware dubbed ExpensiveWall. The malware, which was downloaded between 1 million to 4.2 million times, sends fraudulent premium SMS messages for fake fee-based services without the knowledge or permission of users,...

Samsung Internet Browser - SOP Bypass Exploit

Exploit for Android platform in category remote exploits Hi team, below advisory for your reference, Exploit Title: SOP Bypass Date: 06 Septmber 2017 Software Link: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Exploit Author: Dhiraj Mishra Contact:...

Android Security Bulletin—September 2017Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of September 05, 2017 or later address all of these issues. Refer to the Pixel and Nexus update schedule to learn how to check a device's security patch level. Partners were...