Coosi Box : Creative Drawing - External URLs, Possible privilege escalation, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Coosi Box : Creative Drawing published at the 'play' market has multiple vulnerabilities...

Box Game - Base64 encoded String, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Box Game published at the 'play' market has multiple vulnerabilities...

Cars in Gift Box (app 4 kids) - Dynamic Code Loading, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Cars in Gift Box app 4 kids published at the 'play' market has multiple vulnerabilities...

Fairy tale "Music Box" 6+ Free - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Fairy tale "Music Box" 6+ Free published at the 'play' market has multiple vulnerabilities...

Laser Box - Puzzle - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Laser Box - Puzzle published at the 'play' market has multiple vulnerabilities...

Open Puzzle Box - Base64 encoded String, Customized SSL, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Open Puzzle Box published at the 'play' market has multiple vulnerabilities...

Beat Box - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Beat Box published at the 'play' market has multiple vulnerabilities...

Kitty in the Box - Base64 encoded String, Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Kitty in the Box published at the 'play' market has multiple vulnerabilities...

Ghost Commander plugin for BOX - Suspicious files, Unsafe deleting, WebView JavaScript enabled vulnerabilities

HackApp vulnerability scanner discovered that application Ghost Commander plugin for BOX published at the 'play' market has multiple vulnerabilities...

Coin Bank 2.0 - Cash Box - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Coin Bank 2.0 - Cash Box published at the 'play' market has multiple vulnerabilities...

Trader's Box - Base64 encoded String, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Trader's Box published at the 'play' market has multiple vulnerabilities...

Alarm Box - Exported components, External URLs, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application Alarm Box published at the 'play' market has multiple vulnerabilities...

Tool Box (Free) - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Tool Box Free published at the 'play' market has multiple vulnerabilities...

Axil CMS 3.0 Cross Site Scripting

Exploit Title : Axil CMS 3.0 Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.axilcreations.com/ Date: 2016/03/31 Version : 3.0 PoC: Search Box Vulnerable To XSS Payload = "Hacked By D: Demo : http://www.excelsior.edu.np/ http://jmeremit.com.np/ http://nrnil.co...

Shopify: xss in the all widgets of shopifyapps.com

i found xss in all widgets.shopifyapps.com/ google dork:site:widgets.shopifyapps.com the parameter "padding" is vulnerable,xss payload - %0ax:expressionalert1%0a xss does work in inetrnet explorer browsers for ie10,ie11 in compatibility mode , for ie5,ie6,ie7 for ie8,ie9 javascript is disabled, t...

Black Box AlertWerks ServSensor Credential Management Vulnerability

OVERVIEW Independent researcher Lee Ryman has identified a credential management vulnerability in Black Box’s AlertWerks ServSensor devices. ICS-CERT and CERT Australia have coordinated with Black Box that has produced a new firmware version to mitigate this vulnerability. Lee Ryman has tested th...

webSPELL SQL Injection Vulnerability

webSPELL is a WEB-based content management program. A SQL injection vulnerability exists in webSPELL. Input passed to the "/cashbox.php" script via the "payid" HTTP POST parameter is not sufficiently filtered, allowing an attacker to query the application's database and execute arbitrary SQL...

Unspecified vulnerability in Mozilla Firefox protocol-handler dialog box

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in the protocol-handler dialog box in Mozilla Firefox versions prior to 44.0. The vulnerability can be exploited by remote attackers to conduct clickjacking...

the-open-box.com XSS vulnerability

Open Bug Bounty ID: OBB-129715 Description| Value ---|--- Affected Website:| the-open-box.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

jspxcms admin backend login page cross-site scripting vulnerability

jspxcms is an open source, Java-based content management system CMS. A cross-site scripting vulnerability exists in the administration backend login page of jspxcms version v5.2.4, due to analyzing the search box on the front page of Jspxcms for user inputs that are not input filtered. This...