CVE-2018-15000

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.smartshot versionCode=1, versionName=3.0.0. This app contains an exported service named...

EXNESS: [com.exness.android.pa Android] Universal XSS in webview. Lead to steal user cookies

Details: Package: com.exness.android.pa Name: Exness Version: 1.7.5-real-release Description: Third-app may use exported activity to load any url in internal webView. This leads to steal cookies used in trading app, including cookies of payment system Vulnerability description: Application has...

Critical OkCupid Flaw Exposed Daters to App Takeovers

A critical flaw in the OkCupid app has been found that could allow a bad actor to steal credentials, launch man-in-the-middle attacks or completely compromise the victim’s application. This is separate from the OKCupid account-takeover incident reported earlier in the week, but it does fit the...

CVE-2018-15004

CVE-2018-15004 concerns the Coolpad Canvas Android device where a platform app (com.qualcomm.qti.modemtestmode) exposes MbnTestService, enabling any app to set persist.service.logr.enable as the com.android.phone user. When enabled, a malicious app (e.g., com.yulong.logredirect) can trigger syste...

ZyXEL NSA325 V2 Cross-Site Request Forgery Vulnerability

The ZyXEL NSA325 V2 is a network storage device from Hopkins ZyXEL Technology. A security vulnerability exists in the web application of the ZyXEL NSA325 V2 version 4.81. The vulnerability can be exploited by an attacker to perform a state change operation using a specially crafted HTTP form...

Beijing Beifang Founder Electronics Company Limited Economic Reference News APP has information leakage vulnerability

Economic Reference News App is a news and information application. An information leakage vulnerability exists in the Economic Reference News APP of Beijing Beifang Founder Electronics Co. An attacker can register any account, reset any password and perform unauthorized operations by capturing th...

PLANEX CS-QR20 Hardcoded Voucher Vulnerability

PLANEX is a Japanese networking brand company brands PCI and PLANEX. We provide products from enterprise customers to home customers e.g., network cards, routers, switches, L3 managed switches, accessories, Bluetooth products, print servers, Apple peripherals, network storage devices, etc.. PLANE...

Lightning Price Drop app suffers from an override access vulnerability

Lightning Price Drop app is an online shopping application, which is a shopping platform of Shanghai Huanshang E-commerce Co. Lightning Price Drop app suffers from an unauthorized access vulnerability. An attacker can exploit this vulnerability to gain unauthorized access to user information...

Apple iOS Web App Security Bypass Vulnerability

Apple iOS is a set of operating systems developed by Apple for mobile devices, of which Web App is a Web application component. A security vulnerability exists in the Web App component in Apple iOS versions prior to 11.3. A remote attacker can exploit this vulnerability to bypass the cookie...

CVE-2017-2723

The Files APP 7.1.1.308 and earlier versions in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users' plaintext Safe passwords, leading to information leak...

Arbitrary User Login Vulnerability in 365 Housing Worry-Free App

365 Housing Worry-Free App is a home service app that provides one-stop service for daily home maintenance, repairs, tool rental and more. 365 Housing Worry-Free App has an arbitrary user login vulnerability, attackers can login to any user account by grabbing packets and modifying the cell phone...

CVE-2017-14582

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate...

Huawei Vicky-AL00A Mailbox APP suffers from stored XSS vulnerability

The Huawei Vicky-AL00A is a smartphone device from the Chinese company Huawei Huawei. The Huawei Vicky-AL00A Mailbox APP suffers from a stored XSS vulnerability, which can be exploited by a remote attacker to send emails with malicious code due to a lack of sufficient validation of the parameters...

E-Care Online APP (Patient Side) Android Version Has Override Access Vulnerability

E-nursing online platform is a platform that provides professional nursing services for the majority of users through the development of an innovative health care service model by Shenyang Shengtai Internet Technology Co. The Android version of E-nursing Online APP patient side has an oversteppin...

Information leakage vulnerability in Aliyun OSS credentials for Advanced Medical Examination BaoDian

Advanced Medical Exam App is a physician exam material application exam study question bank app. There is an information leakage vulnerability in the Medical Advanced Title Exam BaoDian AliCloud OSS credentials. The vulnerability is caused by credential leakage due to the use of SDK with...

Hack Telegram, WhatsApp and Signal app; get $500,000

By Waqas If you are a hacker or a security researcher, it This is a post from HackRead.com Read the original post: Hack Telegram, WhatsApp and Signal app; get $500,000...

Stored Cross-Site Scripting Vulnerability in Tea Bugs App

The Tea Bug app is a and a mobile software specially created for those who love tea culture. Tea Bug app has a stored cross-site scripting vulnerability. Allows an attacker to insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

Shenzhen Armed Police Hospital's Android APP suffers from overstepping access vulnerability

"Shenzhen Armed Police Hospital" is the Shenzhen Armed Police Hospital official cell phone application software, designed to simplify the process of medical treatment on the basis of the hospital's existing services, reduce the waiting time for medical treatment, convenient for patients to seek...

vc movie app has a payment logic design flaw

vc movie app is a movie information software on the phone. The vc movie app has a payment logic design vulnerability. Attackers use the vulnerability to bypass the payment verification mechanism to modify the payment amount...

Banco de Costa Rica BCR Movil app for iOS Man-in-the-Middle Attack Vulnerability

Banco de Costa Rica BCR Movil app for iOS is a mobile app for iOS from Banco de Costa Rica with quick access to manage your bank account, manage your balances, pay bills and send money. A security vulnerability exists in version 3.7 of the Banco de Costa Rica BCR Movil app for iOS-based platforms...