WordPress APK Downloader plugin <= 1.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin APK Downloader versions = 1.0.0...

WordPress APK Downloader Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software APK Downloader Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51654 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 501bc3a355c2 Credits SOPROBRO Required...

Russian Espionage Group Targets Ukrainian Military with Malware via Telegram

A suspected Russian hybrid espionage and influence operation has been observed delivering a mix of Windows and Android malware to target the Ukrainian military under the Telegram persona Civil Defense. Google's Threat Analysis Group TAG and Mandiant are tracking the activity under the name UNC581...

CVE-2024-48542

Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48545

Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48546

Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48548

The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack...

CVE-2024-48544

Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48547

Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48538

Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48545

Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48548

The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack...

CVE-2024-48542

Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48542

The Yamaha Headphones Controller (version v1.6.7 ) is vulnerable to incorrect access control within its firmware update and download processes. This flaw allows attackers to access sensitive information by analyzing the code and data contained within the APK file . As of the provided documentatio...

CVE-2024-48542

Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48548

The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack...

CVE-2024-48541

The Ruochan Smart smart home control software (version v4.4.7 ) contains an incorrect access control vulnerability within its firmware update and download processes. This flaw allows an attacker to access sensitive information by analyzing the code and data contained within the APK file . No spec...

CVE-2024-48540

Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-48545

The IVY Smart smart home application (developed by Shenzhen Aiwei IOT Technology Co. ) version v4.5.0 is vulnerable to incorrect access control within its firmware update and download processes. This flaw enables attackers to gain access to sensitive information by analyzing the code and data con...

CVE-2024-48546

The YingSheng Wear Sync mobile application (v1.2.0) suffers from incorrect access control during its firmware update and download processes. This vulnerability allows attackers to extract sensitive information by performing analysis on the code and data contained within the APK file . To mitigate...