Unpatched Bug in WiFi Mouse App Opens PCs to Attack

The mobile application called WiFi Mouse, which allows users to control mouse movements on a PC or Mac with a smartphone or tablet, has an unpatched bug allowing adversaries to hijack desktop computers, according to researcher Christopher Le Roux who found the flaw. Impacted is the Android app’s...

Unpatched Android App with 1B Downloads Allows RCE

An Android app that’s been downloaded more than 1 billion times is riddled with flaws that can let attackers hijack app features or overwrite existing files to execute malicious code, or launch man-in-the-disk MiTD attacks on people’s devices, researchers discovered. The flaws exist in an app...

A vulnerability exists in the Android version of the Miramar app that does not disable app debugging privileges.

The Beauty Talk app is a software used for online shopping. A vulnerability exists in the Android version of Meilizhou app where the APP debugging privilege is not closed. Attackers can use the vulnerability to debug the app to obtain sensitive user information...

CVE-2020-5799

The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileged access to restricted functionality and to other users' data...

Unauthorized Access Vulnerability in uni-app of Digital Paradise (Beijing) Network Technology Co.

uni-app is a framework for developing all front-end applications using Vue.js, developers write a set of code that can be published to H5, and a variety of small programs WeChat/Alipay/Baidu/Headline/QQ/Pin/Nail/Taobao, fast apps and other platforms, and can be directly packaged in HBuilderX to...

Beijing Perfect Creative Technology Co., Ltd.'s More Beauty APP Has Denial of Service Vulnerability

More beautiful APP a mobile plastic surgery information sharing platform, users through this software can learn about today's plastic surgery market, but also can learn about the cost of various types of plastic surgery. A denial-of-service vulnerability exists in the Beijing Perfect Creative...

Online Discussion Forum Site 1.0 - Remote Code Execution

Exploit Title: Online Discussion Forum Site 1.0 - Remote Code Execution Google Dork: N/A Date: 2020-05-24 Exploit Author: Selim Enes 'Enesdex' Karaduman Vendor Homepage: https://www.sourcecodester.com/php/14233/online-discussion-forum-site.html Software Link:...

CVE-2019-20801

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code that accesses a user's data via...

X (Formerly Twitter): iOS app crashed by specially crafted direct message reactions

Summary: iOS app crashed by specially crafted direct message reactions Description: Twitter does not properly sanitize direct message reactions, making it possible for arbitrary reaction text to be shown to the user via the message preview in the direct message list. Special characters such as \r...

CVE-2019-19463

The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check...

CVE-2019-15348

The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service named...

Code injection

The Samsung J7 Max Android device with a build fingerprint of samsung/j7maxlteins/j7maxlte:8.1.0/M1AJQ/G615FXXU2BSB1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other pre-installed...

Design/Logic Flaw

The Lava Z61 Android device with a build fingerprint of LAVA/Z612GB/Z612GB:8.1.0/O11019/1533889281:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the device to...

CVE-2019-15438

The Samsung XCover4 Android device with a build fingerprint of samsung/xcover4ltedo/xcover4lte:8.1.0/M1AJQ/G390YDXU2BSA1:user/release-keys contains a pre-installed app with a package name of com.samsung.android.themecenter app versionCode=7000100, versionName=7.0.1.0 that allows other pre-install...

CVE-2019-15430

The Bluboo D3 Pro Android device with a build fingerprint of BLUBOO/BlubooD2Pro/BlubooD2Pro:7.0/NRD90M/1510370501:user/release-keys contains a pre-installed app with a package name of com.qiku.cleaner app versionCode=2, versionName=2.0.0VER32516508295515 that allows other pre-installed apps to...

CVE-2019-15363

The Leagoo Power 5 Android device with a build fingerprint of LEAGOO/Power5/Power5:8.1.0/O11019/1532686195:user/release-keys contains a pre-installed app with a package name of com.mediatek.wfo.impl app versionCode=27, versionName=8.1.0 that allows any app co-located on the device to modify a...

CVE-2019-18924

Systematic IRIS WebForms 5.4 is vulnerable to directory traversal. By manipulating variables that reference files with ../ and variations, it is possible to list all the directories and check if a particular file exists...

CVE-2019-1020006

invenio-app before 1.1.1 allows host header injection...

PYSEC-2019-94

invenio-app before 1.1.1 allows host header injection...

CVE-2019-11730

A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and...