CVE-2015-9019

In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs...

Programmers are also people who also make mistakes

It's the first part of our talk with Daniil Svetlov at his radio show "Safe Environment" or "Safe Wednesday" - kind of wordplay in Russian recorded 29.03.2017. We were discussing why Software Vulnerabilities are everyone's problem. Full video in Russian without subtitles is available here. I adde...

SUSE-SU-2017:0460-1 Security update for java-1_8_0-ibm

This update for java-180-ibm to version 8.0-4.0 fixes a lot of security issues bsc1024218: Following CVEs are fixed: CVE-2016-5552 CVE-2017-3231 CVE-2017-3241 CVE-2017-3253 CVE-2017-3259 CVE-2017-3261 CVE-2017-3272 CVE-2017-3289 CVE-2016-2183 CVE-2016-5547 CVE-2016-5548 CVE-2016-5549 CVE-2017-325...

Marco Polo Video Walkie Talkie - BSD license, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Marco Polo Video Walkie Talkie published at the 'play' market has multiple vulnerabilities...

WiWo - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application WiWo published at the 'play' market has multiple vulnerabilities...

FTC Issues Public Challenge to Improve IoT Patching

Admittedly, patching existing connected devices in the wild is easier said than done. But that’s not deterring the Federal Trade Commission from soliciting help in finding a solution. The U.S. government agency today announced the kickoff of the FTC IoT Home Inspector Challenge, a prize contest...

Followers. - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Followers. published at the 'play' market has multiple vulnerabilities...

CVE-2016-9856

An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions prior to 4.6.5, 4.4.x versions prior to 4.4.15.9, and 4.0.x versions prior to 4.0.10.18 are...

CVE-2016-6623

An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service DoS attack on a server by passing large values to a loop. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...

SUSE-SU-2016:3053-1 Security update for w3m

This update for w3m fixes the following issues: - update to debian git version bsc1011293 addressed security issues: CVE-2016-9622: w3m: null deref bsc1012021 CVE-2016-9623: w3m: null deref bsc1012022 CVE-2016-9624: w3m: near-null deref bsc1012023 CVE-2016-9625: w3m: stack overflow bsc1012024...

ISTUDENT - External URLs, WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application ISTUDENT published at the 'play' market has multiple vulnerabilities...

MGASA-2016-0329 Updated firefox/rootcerts/nss packages fix security vulnerability

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-5257, CVE-2016-5278, CVE-2016-5270, CVE-2016-5272,...

OPENSUSE-SU-2016:1980-1 Security update for redis

This update for redis fixes the following issues: - CVE-2013-7458: unsafe permissions of command line history boo991250...

Docker security of those things-vulnerability warning-the black bar safety net

In the past year, the container being at an amazing speed of development, the country also has a large number of Internet companies in the production environment using Docker, which are also million units of the scale. The other day the clouds exposed Swarm configuration problem caused by the...

The vulnerability of the Microsoft Office software allows a malicious attacker to execute arbitrary code with privileges of the current user.

Microsoft Office software vulnerabilities, related to errors in processing specially crafted files. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary code with privileges of the current user...

CVE-2016-5734

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the pregreplace e aka eval modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table...

Spreaker Podcast Radio - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Spreaker Podcast Radio published at the 'play' market has multiple vulnerabilities...

MGASA-2016-0211 Updated phpmyadmin package fixes CVE-2016-5099

In phpMyAdmin before 4.4.15.6, a specially crafted attack could allow for special HTML characters to be passed as URL encoded values and displayed back as special characters in the page CVE-2016-5099...

AirWatch Container - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application AirWatch Container published at the 'play' market has multiple vulnerabilities...

Apple hires Encryption Expert to Beef Up Security on its Devices

The FBI and other law enforcement agencies have waged legal war on encryption and privacy technologies. You may have heard many news stories about the legal battle between Apple and the FBI over unlocking an iPhone that belonged to the San Bernardino shooter. However, that was just one battle in ...