2010 matches found
OkCupid Dating App Flaws Could've Let Hackers Read Your Private Messages
Cybersecurity researchers today disclosed several security issues in popular online dating platform OkCupid that could potentially let attackers remotely spy on users' private information or perform malicious actions on behalf of the targeted accounts. According to a report shared with The Hacker...
Researchers Reveal New Security Flaw Affecting China's DJI Drones
Cybersecurity researchers on Thursday revealed security issues in the Android app developed by Chinese drone-maker Da Jiang Innovations DJI that comes with an auto-update mechanism that bypasses Google Play Store and could be used to install malicious applications and transmit sensitive personal...
Researchers Reveal New Security Flaw Affecting China's DJI Drones
Cybersecurity researchers on Thursday revealed security issues in the Android app developed by Chinese drone-maker Da Jiang Innovations DJI that comes with an auto-update mechanism that bypasses Google Play Store and could be used to install malicious applications and transmit sensitive personal...
Unauthorized Access Vulnerability in Time Sequence Android APP of Peanut Future (Guangzhou) Technology Co.
Time Sequence App is a schedule management software. Peanut Future Guangzhou Technology Co. Ltd Time Sequence APP for Android has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...
Unauthorized Access Vulnerability in Dolphin Notebook Order Android APP of Beijing Smooth Entertainment Technology Co.
Dolphin Bookkeeping App is a professional and simple mobile bookkeeping software. There is an unauthorized access vulnerability in Dolphin Bookkeeping App for Android, which can be exploited by attackers to obtain sensitive information...
Unauthorized Access Vulnerability in Micro Sugar Android APP of Shanghai Geping Information Technology Co.
The Micro Sugar app is a mobile app that helps users manage their blood sugar. An unauthorized access vulnerability exists in Shanghai Geping Information Technology Co.'s Micro Sugar Android app, which can be exploited by attackers to obtain sensitive information...
Unauthorized Access Vulnerability in AA Travel Android APP of Shanghai Youheng Hotel Management Co.
AA Travel app is a hotel booking software. Shanghai Youheng Hotel Management Co., Ltd AA Travel Android App has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information...
CVE-2020-5604
Android App 'Mercari' Japan version prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView...
CVE-2020-5604
Android App 'Mercari' Japan version prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView...
Directory traversal
MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILELIST" with a...
CVE-2020-5764
CVE-2020-5764 – MX Player Android App vulnerable versions: MX Player Android App earlier than v1.24.5. A directory traversal flaw exists in the MX Transfer feature when used in “Receive” mode. An attacker can act as a MX Transfer sender and send a FILE_LIST message with a name field containing di...
CVE-2020-5764
MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILELIST" with a...
PT-2020-18685
Name of the Vulnerable Software and Affected Versions MX Player Android App versions prior to v1.24.5 Description The issue allows an attacker to exploit a directory traversal vulnerability when the user is using the MX Transfer feature in "Receive" mode. This can be achieved by sending a...
CVE-2020-5764: Improper Limitation of a Pathname to a Restricted Directory
MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILELIST" with a...
CVE-2020-11882
The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle deeplinks that can be delivered either via links or by directly calling the activity. However, the deeplink format is not properly...
Shopify: STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend
I discovered a bug in an android mobile app that allowed STAFF No Permissions using Receipt Send to Mobile of any Order information in the Store. Steps to reproduce: 1 STAFF account is created and assigned "No Permissions" on a Shop by Owner/Admin 2 STAFF then login to shop. Notice that STAFF is...
My Adventures Hacking the iParcelBox
ARCHIVED STORY My Adventures Hacking the iParcelBox By Sam Quinn · June 18, 2020 In 2019, McAfee Advanced Threat Research ATR disclosed a vulnerability in a product called BoxLock. Sometime after this, the CEO of iParcelBox, a U.K. company, reached out to us and offered to send a few of their...
CVE-2019-16252
Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests, including login credentials and location data...
Mail.ru: ICQ Android APP remote DoS
Memory corruption issue on GIF image processing leads to ICQ for Android application crash with potential for code execution. before testing and reporting DoS conditions please check @mailru rules and scope description to avoid signal/reputation loss, not every DoS report is accepted...