Fast Followers Boost - Corrupted files, Exported components, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Fast Followers Boost published at the 'play' market has multiple vulnerabilities...

CVE-2017-12344

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting...

CVE-2017-16899

An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the readtextobject functions in read.c and read13.c...

MGASA-2017-0349 Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 3.3.4, which fixes several security vulnerabilities and other bugs which were corrected upstream...

Proof It's Possible to Hack German Elections; Hackers Tamper with Voting-Software

Germany's democracy is in danger, as the upcoming federal elections in the country, where nearly 61.5 million citizens are going to vote on September 24th, could be hijacked. Hackers have disclosed how to hack the German voting software to tamper with votes and alter the outcome of an election...

MGASA-2017-0295 Updated avidemux packages fix security vulnerabilities

The avidemux package has been updated to version 2.7.0. Avidemux includes a bundled copy of the ffmpeg libraries, which have been updated from version 3.0.7 to version 3.3.3, fixing several security issues and other bugs...

SUSE-SU-2017:2090-1 Security update for Linux Kernel Live Patch 16 for SLE 12 SP1

This update for the Linux Kernel 3.12.74-606445 fixes several issues. The following security bugs were fixed: - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-9242: The ip6appenddata function in net/ipv6/ip6output.c in the Linux kernel is too...

Internet Speed Meter Lite - Exported components, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Internet Speed Meter Lite published at the 'play' market has multiple vulnerabilities...

Legislation Proposed to Secure Connected IoT Devices

A Senate bill introduced today would prioritize security in connected devices, requiring providers who sell to the U.S. government to implement measures that would have been an impediment to the IoT botnet-fueled attacks against DNS provider Dyn and webhost OVH. The Internet of Things Cybersecuri...

Measuring Vulnerability Rediscovery

New paper: "Taking Stock: Estimating Vulnerability Rediscovery," by Trey Herr, Bruce Schneier, and Christopher Morris: Abstract: How often do multiple, independent, parties discover the same vulnerability? There are ample models of vulnerability discovery, but little academic work on this issue o...

Ethereum Hacks

The press is reporting a $32M theft of the cryptocurrency Ethereum. Like all such thefts, they're not a result of a cryptographic failure in the currencies, but instead a software vulnerability in the software surrounding the currency -- in this case, digital wallets. This is the second Ethereum...

Balance. Финансовое равновесие - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Balance. Финансовое равновесие published at the 'play' market has multiple vulnerabilities...

Subaru car software vulnerability analysis—never a failure of token-vulnerability warning-the black bar safety net

Not long ago, one from California car, information security researcher Aaron Guzman, in Australia, held a computer security conference to introduce a black into the Subaru car of the method. In his own 2017 Subaru WRX STI was found in a surprising number of software vulnerabilities, through these...

Deep dive in Lexmark Perceptive Document Filters Exploitation

This post authored by Marcin Noga with contributions from Nick BiasiniIntroductionTalos discovers and releases software vulnerabilities on a regular basis. We don't always publish a deep technical analysis of how the vulnerability was discovered or its potential impact. This blog will cover these...

OPENSUSE-SU-2017:1505-1 Security update for irssi

This update to irssi 1.0.3 fixes the following vulnerabilities: - CVE-2017-9469: irssi: dcc crash with incorrect quoting bsc1043052 - CVE-2017-9468: irssi: dcc message crash without nick/host bsc1043051...

Token iPKO - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Token iPKO published at the 'play' market has multiple vulnerabilities...

CVE-2016-9840 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-11-openj9, mysql, openjdk-21-openj9, openjdk-25-openj9, openjdk-8-openj9, openjdk-17-openj9...

CVE-2016-9843 vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-11-openj9, mysql, openjdk-21-openj9, openjdk-25-openj9, openjdk-8-openj9, openjdk-17-openj9...

PATCH Act Calls for VEP Review Board

The U.S. government took the first steps toward codifying the Vulnerabilities Equities Process into law yesterday through the introduction of the Protecting Our Ability to Counter Hacking PATCH Act of 2017. The VEP is the internal process by which the government decides which software...

Vulnerability Quadrants

Hi everyone! Today I would like talk about software vulnerabilities. How to find really interesting vulnerabilities in the overall CVE flow. And how to do it automatically. First of all, let's talk why we may ever need to analyze software vulnerabilities? How people usually do their Vulnerability...