Buffer overflow

In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash...

CVE-2021-30139

CVE-2021-30139 affects Alpine Linux apk-tools prior to 2.12.5. The tarball parser contains a buffer overflow that can cause a crash (availability impact). Upgrading to apk-tools 2.12.5 or later is the documented remediation. This vulnerability is supported by multiple sources across OSV, NVD, Red...

CVE-2021-30139

In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash...

CVE-2021-30139

In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash...

Alpine Linux apk-tools 缓冲区错误漏洞

Alpine Linux is a lightweight Linux distribution for security applications. apk-tools is one of the shell-based package managers. A security vulnerability exists in Alpine Linux apk-tools versions prior to 2.12.5, which stems from a buffer overflow and crash allowed by the tarball parser...

Out-of-Bounds Read

apk-tools is vulnerable to out-of-bound read. The vulnerability exists due to insufficient sanity checks on tar entries...

CVE-2021-21386

The CVE-2021-21386 entry concerns APKLeaks, an open-source APK scanner. The vulnerability arises in APKLeaks prior to v2.0.3, where a crafted package name inside an Android app manifest can lead to remote command execution on the host system. This could allow an attacker to run arbitrary OS comma...

Dw1 apkleaks 参数注入漏洞

Dw1 apkleaks is a Dw1 open source application . It is used to scan APK files for URIs, endpoints and secrets. A security vulnerability exists in APKLeaks prior to v2.0.3, which can be exploited by an attacker to contain allow execution of unexpected commands or code...

Man In The Middle (MitM)

node-apk-parser is vulnerable to man-in-the-middle MitM attacks. This is because the library downloads binaries via HTTP, allowing MitM attacks. It may also cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or...

Unpatched ShareIT Android App Flaw Could Let Hackers Inject Malware

Multiple unpatched vulnerabilities have been discovered in SHAREit, a popular app with over one billion downloads, that could be abused to leak a user's sensitive data, execute arbitrary code, and possibly lead to remote code execution. The findings come from cybersecurity firm Trend Micro's...

Metasploit Framework 6.0.11 Command Injection

Exploit Title: Metasploit Framework 6.0.11 - msfvenom APK template command injection Exploit Author: Justin Steven Vendor Homepage: https://www.metasploit.com/ Software Link: https://www.metasploit.com/ Version: Metasploit Framework 6.0.11 and Metasploit Pro 4.18.0 CVE : CVE-2020-7384 !/usr/bin/e...

Italy CERT Warns of a New Credential Stealing Android Malware

Researchers have disclosed a new family of Android malware that abuses accessibility services in the device to hijack user credentials and record audio and video. Dubbed "Oscorp" by Italy's CERT-AGID and spotted by AddressIntel, the malware "induces the user to install an accessibility service wi...

Metasploit Framework 6.0.11 - msfvenom APK template command injection

Exploit Title: Metasploit Framework 6.0.11 - msfvenom APK template command injection Exploit Author: Justin Steven Vendor Homepage: https://www.metasploit.com/ Software Link: https://www.metasploit.com/ Version: Metasploit Framework 6.0.11 and Metasploit Pro 4.18.0 CVE : CVE-2020-7384 !/usr/bin/e...

Metasploit Framework 6.0.11 - msfvenom APK template command injection Exploit

Exploit Title: Metasploit Framework 6.0.11 - msfvenom APK template command injection Exploit Author: Justin Steven Vendor Homepage: https://www.metasploit.com/ Software Link: https://www.metasploit.com/ Version: Metasploit Framework 6.0.11 and Metasploit Pro 4.18.0 CVE : CVE-2020-7384 !/usr/bin/e...

HosTaGe - Low Interaction Mobile Honeypot

HosTaGe is a lightweight, low-interaction, portable, and generic honeypot for mobile devices that aims on the detection of malicious, wireless network environments. As most malware propagate over the network via specific protocols, a low-interaction honeypot located at a mobile device can check...

APKLab - Android Reverse Engineering WorkBench For VS Code

APKLab seamlessly integrates the best open-source tools: Apktool, Jadx, uber-apk-signer and more to the excellent VS Code so you can focus on app analysis and get it done without leaving the IDE. Features Decode all the resources from an APK Disassemble the APK to Dalvik bytecode aka Smali...

Iranian RANA Android Malware Also Spies On Instant Messengers

A team of researchers today unveiled previously undisclosed capabilities of an Android spyware implant—developed by a sanctioned Iranian threat actor—that could let attackers spy on private chats from popular instant messaging apps, force Wi-Fi connections, and auto-answer calls from specific...

Damn-Vulnerable-Bank - Vulnerable Banking Application For Android

Damn Vulnerable Bank Android Application aims to provide an interface for everyone to get a detailed understanding with internals and security aspects of android application. How to Use Application Clone the repository and run the Backend Server as per instructions in the link. We have released t...

Rapid7 Metasploit Framework msfvenom APK Template Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in Metasploit Framework's msfvenom payload generator when using a crafted APK file as an Android payload template. Affected includes Metasploit Framework versions 6.0.11 and below and Metasploit Pro versions 4.18.0 and below. This...

Rapid7 Metasploit Framework msfvenom APK Template Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip/jar' class MetasploitModule 'Rapid7 Metasploit Framework msfvenom APK Template Command Injection', 'Description' = %q This module exploits a command...