Unique Heart Rate Monitor - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Unique Heart Rate Monitor published at the 'play' market has multiple vulnerabilities...

Exchange rate. All currency - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Exchange rate. All currency published at the 'play' market has multiple vulnerabilities...

Pulse Heart Rate Watch Face - Exported components, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Pulse Heart Rate Watch Face published at the 'play' market has multiple vulnerabilities...

Heart Rate OS for Android Wear - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Heart Rate OS for Android Wear published at the 'play' market has multiple vulnerabilities...

Heart Rate - Sport Gear + Wear - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Heart Rate - Sport Gear + Wear published at the 'play' market has multiple vulnerabilities...

Heart Rate Monitor ANT+ BLE - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Heart Rate Monitor ANT+ BLE published at the 'play' market has multiple vulnerabilities...

New Relic: Mobile Authentication Endpoint Credentials Brute-Force Vulnerability

Dear, Your web authentication login endpoint, https://login.newrelic.com/login, currently properly protects against brute-force attacks. After a couple of 100 automated login attempts, a Captcha is required to login to the account under attack, even from a different IP address. Perfect, good job....

Uber: Brute Forcing rider-view Endpoint Allows for Counting Number of Active Uber Drivers

m.uber.com has an endpoint at https://m.uber.com/proxy-rt/product/city/rider-view that when called will return a list of nearby vehicles. By iterating through all latitudes and longitudes, it is possible to count the total number of active Uber drivers. The full URL to be called is...

Root Servers Were Not Targets of 2015 DDoS Attack

When the Internet’s root name servers are in the line of fire of a DDoS attack, people start to sweat, and with good reason since they are the authoritative servers used to resolve IP addresses. The most recent attacks against the root servers happened over a two-day period starting last Nov. 30,...

Uber: Possibility to enumerate and bruteforce promotion codes in Uber iOS App

Due to the lack of rate limiting on the promo code redemption endpoint, it was possible to enumerate promo codes. The response also leaked metadata about the user, including the country of the user, their name and profile photo. Thanks, @r0t! Uber has a feature in the iOS app to apply a promotion...

Uber: Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers

Invite codes are 5 alphanumeric lower case characters. This means there are 36 26 + 10 possible options for each space in the invite code. In total this means there are 36^5 or 60,466,176 possible invite codes. Through enumerating through all possible invite codes, one can find the total number o...

Vimeo: Missing rate limit on private videos password

Missing rate limit on password protected clips. Rate-limits is a non-qualifying bug at this time. We have received multiple reports of this in the past, however, since that time we have implemented a clip password rate limit. This was not appropriately applied to all clip password areas, so we've...

New Relic: No Rate Limitation on Promo Code

Hello, there is no rate limitation on entering "promo code" while upgrading the subscription. an attacker can bruteforce the promo code and could get a lot of benefits with that. https://rpm.newrelic.com/accounts/XXXXXXX/products i have tested this bug by attempting 500+ invalid promo code. and g...

Hacker Reveals How to Hack Any Facebook Account

Hacking Facebook account is one of the major queries of the Internet user today. It's hard to find — how to hack Facebook account, but an Indian hacker just did it. A security researcher discovered a 'simple vulnerability' in the social network that allowed him to easily hack into any Facebook...

Legal Robot: Rate limiting on password reset links

Security researcher discovered a potential issue where no rate limiting was applied to sensitive functions, like password reset links...

Russian Hackers Manipulate Ruble-Dollar Exchange Rate with Malware

Russian Group of Hackers reportedly cracked into the Kazan-based Energobank and messed up with the Ruble-Dollar exchange rates. In Feb 2015, a hacking group, known by the name METEL, successfully breached into the Russian Regional Bank for just 14 minutes and caused the exchange rate to fluctuate...

DEBIAN-CVE-2015-8737

The mp2topen function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted file...

UBUNTU-CVE-2015-8737

The mp2topen function in wiretap/mp2t.c in the MP2T file parser in Wireshark 2.0.x before 2.0.1 does not validate the bit rate, which allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted file...

Fastest Internet Port Scanner: MASSCAN

This is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second. It produces results similar to nmap , the most famous port scanner. Internally, it operates more like scanrand , unicornscan , and ZMap , using asynchronous...

Oracle Linux 7 : ntp (ELSA-2015-2231)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2231 advisory. - check origin timestamp before accepting KoD RATE packet CVE-2015-7704 - allow only one step larger than panic threshold with -g CVE-2015-5300 -...