Android MDK Trojan Found Lurking in 11K Apps, Using AES Encryption

Android.Troj.mdk, the Trojan botnet that last week was reported to have infected one million devices, mainly Chinese Android phones, is a new variant of a separate strain of malware, Backscript, researchers say. Both variants of malware use the same certificate to sign APKs, yet Troj.mdk MDK uses...

PT-2013-02: Password Reset Token Prediction in FluxBB

The specialists of Positive Technologies have detected a "Password Reset Token Prediction" vulnerability in FluxBB. The vulnerability was detected in password reset token generation algorithm. FluxBB generates weak random numbers using mtrand function: function randomkey$len, $readable = false,...

Code injection

Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value...

MurmurHash algorythm vulnerabilities

It's easy to predict collisions...

Code injection

The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030, mGuard industrial RS, mGuard delta HW before HW-103060 and BD before BD-211010, mGuard PCI, mGuard blade, and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys, whi...

kernel: ipv6: make fragment identifications less predictable

The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service disrupted networking by predicting these values and sending crafted packets...

ClickIt Proof Of Concept

X-Frame-Options is worth less than you think var w; var dummy; var it; // Precache stuff. x = new Image; x.src = 'http://banking.beaver-peak.us/bankinginterface/transfers/'; x2 = new Image; x2.src = 'http://banking.beaver-peak.us/bankinginterface/transfers/beaver-peak.jpg'; x3 = new Image; x3.src...

Ubuntu Update for linux-lts-backport-maverick USN-1242-1

Ubuntu Update for Linux kernel vulnerabilities USN-1242-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN12421.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for linux-lts-backport-maverick USN-1242-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH,...

Prediction Football 2.51 XRF / CSRF

Exploit for php platform in category web applications Exploit Title: title Google Dork: if relevant intext:"Prediction football 2.51" Date: 08/08/2011 Author: Smith Falcon Software Link: http://www.predictionfootball.com/download/download.html Version: 2.51 Tested on: Linux First create a usernam...

Prediction Football 2.51 - Cross-Site Request Forgery

Exploit Title: title Google Dork: if relevant intext:"Prediction football 2.51" Date: 08/08/2011 Author: Smith Falcon Software Link: http://www.predictionfootball.com/download/download.html Version: 2.51 Tested on: Linux First create a username and go to Account Profile The POST variable in...

Design/Logic Flaw

The SecureRandom.randombytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an...

CVE-2011-2686

Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issu...

Zikula < 1.3.1 Security Bypass Vulnerability

Zikula is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2010-4728

The CVE affects Zikula

DHS Investing $40 Million for Cybersecurity Research !

Insider threats, botnets and malware, and assay to abutment the Comprehensive Civic Cyber Initiative CNCI are amid areas of cybersecurity advance the Department of Homeland Aegis DHS will accomplish in budgetary year 2011. The DHS Science and Technology Homeland Aegis Advanced Assay Projects Bure...

Prediction League 0.3.8 Cross Site Request Forgery

======================================================================================== | Title : Prediction League 0.3.8 CSRF Create Admin User Exploit | Author : indoushka | Home : www.iqs3cur1ty.com/vb | Tested on: Lunix Français v.9.4 Ubuntu | Bug : CSRF Create Admin User Exploit...

Prediction League 0.3.8 - Cross-Site Request Forgery (Add Admin)

Prediction League 0.3.8 - Cross-Site Request Forgery Add Admin ======================================================================================== | Title : Prediction League 0.3.8 CSRF Create Admin User Exploit | Author : indoushka | Home : www.iqs3cur1ty.com/vb | Tested on: Lunix Français...

Prediction League 0.3.8 CSRF Create Admin User Exploit

Exploit for php platform in category web applications ====================================================== Prediction League 0.3.8 CSRF Create Admin User Exploit ======================================================...

Prediction League 0.3.8 - Cross-Site Request Forgery (Add Admin)

======================================================================================== | Title : Prediction League 0.3.8 CSRF Create Admin User Exploit | Author : indoushka | Home : www.iqs3cur1ty.com/vb | Tested on: Lunix Français v.9.4 Ubuntu | Bug : CSRF Create Admin User Exploit...

Pwn2Own Predictions: Apple iPhone Will Fall

Hackers at this year’s CanSecWest Pwn2Own contest will definitely break into an Apple iPhone by exploiting a remote code execution vulnerability. That’s the prediction from Charlie Miller and Aaron Portnoy, two security researchers who are monitoring events leading to next week’s hacker challenge...