Nextcloud: Uploading files to a folder where invited user don't have any EDIT privilege

Hi, Any invited user to a shared folder with no edit privilege can create files in it through copy feature of Nextclod android app. Steps to reproduce it + Create any folder and invite a user in it without any edit privilege. + Now login from invited user account through android app. + Copy any...

Arrests Made In $45M Russian Bank Hack

Russian law enforcement has made 50 arrests in connection with a five-year operation to steal three billion rubles just shy of $45 million USD from the country’s largest bank, Sberbank. The hackers are alleged to have exploited websites, including popular news sites, to infect victims with the Lu...

kintone mobile for Android fails to verify SSL server certificates

Overview kintone mobile for Android provided by Cybozu, Inc. fails to verify SSL server certificates. Kusano Kazuhiko reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attack may allow an...

kintone mobile for Android information management vulnerability

Overview kintone mobile for Android provided by Cybozu, Inc. contains an authentication information management vulnerability. Kusano Kazuhiko and Gopinath reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

More than 1 million People now access Facebook Over Tor Network

In Brief Facebook has hit another Milestone: More than 1 MILLION people, or you can say privacy conscious, are accessing Facebook over TOR. Facebook proudly announced today that, this month, for the first time, the people connected to the anonymous version of Facebook that's accessible only throu...

Cherish.com Android APP Man-in-the-Middle Attack Vulnerability

Cherish.com is a matchmaking site. A man-in-the-middle attack vulnerability exists in the Zhenai.com Android APP, where the software does not verify the validity of the TLS certificate when logging in, resulting in a man-in-the-middle that can use self-signed certificates to carry out an attack,...

TileMap - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application TileMap published at the 'play' market has multiple vulnerabilities...

Grim Legends - Base64 encoded String, Dynamic Code Loading, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Grim Legends published at the 'play' market has multiple vulnerabilities...

GPS Logger for Android - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application GPS Logger for Android published at the 'play' market has multiple vulnerabilities...

Chat Alternative — android app - External URLs, Native code usage, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application Chat Alternative — android app published at the 'play' market has multiple vulnerabilities...

Hide pictures - KeepSafe Vault - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Hide pictures - KeepSafe Vault published at the 'play' market has multiple vulnerabilities...

Mandatos Android App - WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Mandatos Android App published at the 'play' market has multiple vulnerabilities...

Remotely Exploitable Bug in Truecaller Puts Over 100 Million Users at Risk

Security researchers have discovered a remotely exploitable vulnerability in Called ID app "Truecaller" that could expose personal details of Millions of its users. Truecaller is a popular service that claims to "search and identify any phone number," as well as helps users block incoming calls o...

CVE-2016-1562

The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter...

CVE-2016-1562

The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter...

Veris: Multiple Stored XSS on Sanbox.veris.in through Veris Frontdesk Android App

Hello Team, I have found multiple cross site scripting vulnerabilities on sanbox.veris.in due to the malicious input injected through veris frontdesk android app. Vulnerable App : Veris Frontdesk Android App Vulnerable Input Fields: 1 Who do you wish to meet? 2 Additional Information Payload used...

Monkey race ray! RSA conference badge scanning application broke vulnerability-vulnerability warning-the black bar safety net

Recently, the BLUE BOX company's security researchers found: RSA 2 0 1 6 The General Assembly on the use of badge scanning APP there is a hard-coded default passwords. This year, RSA 2 0 1 6 The participants will get a unique surprise: the General Assembly, as many manufacturers offer a Samsung...

Kali NetHunter 3.0 - Android Mobile Penetration Testing Platform

What’s New in Kali NetHunter 3.0 NetHunter Android Application Rewrite The NetHunter Android application has been totally redone and has become much more “application centric”. Many new features and attacks have been added, not to mention a whole bunch of community-driven bug fixes. The NetHunter...

One after another: the VTech user data leaked, and was broke two major vulnerability-vulnerability warning-the black bar safety net

Recently, the world's largest infant electronic learning product Maker Vtech（Vtech）is aeration 4 8 0 million parents and 6 4 0 million for children information disclosure. ! Due to this event, Vtech its share price fell to a year low. Followed, with security researchers in their innotab Max produ...

Samsung Android 5. 0 device WifiCredService remote code execution-vulnerability warning-the black bar safety net

The vulnerability is in a few months ago is Google Project Zero and the Quarkslab team found, has only recently been disclosed. The vulnerability only requires the user to browse a website or download a mail attachment or by the basic will not have any rights of a third party malicious programs c...