CVE-2018-13850

The CVE-2018-13850 entry affects the Firebase Cloud Messaging (FCM) + Advance Admin Panel component used for Firebase Push Notification on iOS (up to 2017-10-26). The underlying issue is a SQL injection vulnerability triggered via the username parameter in /advance_push/public/login. This results...

CVE-2018-13850

The "Firebase Cloud Messaging FCM + Advance Admin Panel" component supporting Firebase Push Notification on iOS through 2017-10-26 allows SQL injection via the /advancepush/public/login username parameter...

Thousands of Mobile Apps Expose Their Unprotected Firebase Hosted Databases

Mobile security researchers have discovered unprotected Firebase databases of thousands of iOS and Android mobile applications that are exposing over 100 million data records, including plain text passwords, user IDs, location, and in some cases, financial records such as banking and cryptocurren...

Thousands of Mobile Apps Expose Their Unprotected Firebase Hosted Databases

Mobile security researchers have discovered unprotected Firebase databases of thousands of iOS and Android mobile applications that are exposing over 100 million data records, including plain text passwords, user IDs, location, and in some cases, financial records such as banking and cryptocurren...

Werewolf Online 0.8.8 - Information Disclosure Vulnerability

Exploit for Android platform in category local exploits Exploit Title: Werewolf Online 0.8.8 - Insecure Logging Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online Download Link:...

Werewolf Online Android App Information Leakage Vulnerability

Werewolf Online is a "werewolf" game for Android. Werewolf Online Android 0.8.8 suffers from an information leakage vulnerability, which can be exploited by an attacker to discover Firebase tokens via logcat output...

Werewolf Online 0.8.8 - Information Disclosure

Werewolf Online 0.8.8 - Information Disclosure Exploit Title: Werewolf Online 0.8.8 - Insecure Logging Date: 2018-05-24 Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online Download Link:...

Werewolf Online 0.8.8 - Information Disclosure

Exploit Title: Werewolf Online 0.8.8 - Insecure Logging Date: 2018-05-24 Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online Download Link: https://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details Exploit Author: ManhNho Version...

Werewolf Online 0.8.8 Information Disclosure

Exploit Title: Werewolf Online 0.8.8 - Insecure Logging Date: 2018-05-24 Software Link: https://play.google.com/store/apps/details?id=com.werewolfapps.online Download Link: https://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details Exploit Author: ManhNho Version...

CVE-2018-11505

The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output...

Design/Logic Flaw

The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output...

CVE-2018-11505

The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output...

CVE-2018-11505

Summary : CVE-2018-11505 affects the Android Werewolf Online app (version 0.8.8). An information-disclosure vulnerability exists where an attacker can obtain the Firebase token by reading logcat output, due to insecure logging practices. The connected documents describe the exploit scenario on An...

CVE-2018-11505

The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output...

FireShodanMap - A Realtime Map That Integrates Firebase, Google Maps And Shodan

FireShodanMap is a Realtime map that integrates Firebase and Shodan. A search is carried out using Shodan searching vulnerable devices and they are showed on the map for analysis. All data updated in Firebase are Realtime. Changes We have a file named "fireshodan.py" responsible for fill Firebase...

Jerome Gamez Firebase Admin SDK for PHP Access Control Error Vulnerability

Jerome Gamez Firebase Admin SDK for PHP is a PHP-based software development kit. An access control error vulnerability exists in the src/Firebase/Auth/IdTokenVerifier.php file in the Jerome Gamez Firebase Admin SDK for PHP versions 3.2.0 through 3.8.0, which stems from the program's failure to...

Improper access control

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

CVE-2018-1000025

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

CVE-2018-1000025

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or fro...

CVE-2018-1000025

CVE-2018-1000025 affects Jerome Gamez Firebase Admin SDK for PHP versions 3.2.0–3.8.0. Affected component: src/Firebase/Auth/IdTokenVerifier.php; root cause: token signature is not verified, enabling forging of JWTs with arbitrary email addresses and user IDs. Impact: improper access control via ...