Huawei Vicky-AL00 FRP Bypass Vulnerability

The Huawei Vicky-AL00 is a smartphone product from the Chinese company Huawei Huawei. A security vulnerability exists in versions prior to Huawei Vicky-AL00 Vicky-AL00AC00B172D. During the process of entering FRP to reset the phone, an attacker can exploit the vulnerability to enter Talkback mode...

Security Advisory - FRP Bypass Vulnerability by Talkback in Huawei Smart Phones

There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the Talkback mode and can perform some operations to bypass the Google account verification...

Huawei EVA-L09 Mobile FRP Security Bypass Vulnerability

Huawei EVA-L09 is a smartphone. Huawei EVA-L09 phone has a security vulnerability of FRP bypass. An attacker enters the FRP reset phone process, enters the Swype input method and performs some actions to update the Google account, which leads to FRP feature bypass...

Mixmax: app.mixmax.com Information Discloure on cal.mixmax.com and Not Signing out after Removing information grant access from Google

Hi, I found that there was Email Disclosed in the source code of the public calendar link. PoC: 1: Visit https://cal.mixmax.com/wwelatestevents 2: View Page Source 3: Find email at the end of the page. organizer:...

Seven More Chrome Extensions Compromised

The number of compromised Chrome browser extensions is growing beyond the initial Aug. 1 hijacking of the OCR add-on called Copyfish. Added to list are seven additional legitimate Chrome Extensions that attackers took over and used to manipulate internet traffic and web-based ads, according to...

Snapchat: RCE/LFI on test Jenkins instance due to improper authentication flow

@nahamsec found a test Jenkins instance where they could login with any valid Google account. Once logged in, they gained the ability to execute arbitrary code via the Jenkins Script Console. This was a test jenkins instance with no access to source code or resources. Methodology Here is the...

Huawei Beethoven-W09A and CRR-L09 Mobile Security Bypass Vulnerability

The Huawei Beethoven-W09A and Huawei CRR-L09 are both smartphones from the Chinese company Huawei Huawei. A security bypass vulnerability exists in the Huawei Beethoven-W09A and CRR-L09 phones. An attacker can exploit the vulnerability to bypass the FRP feature by updating a Google account during...

Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones

There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can perform some operations to update the Google account. As a result, the FRP function is bypassed...

Weblate: Login using disconnected google account i.e login using old email id

there is vulnerability that allows loggin in using old email id i.e a disconnected google account attack scenario: 1: attacker has compromised google id of user 2:now user notices this and changes email id and removes previous authentication 3:but still attacker can login using disconnected googl...

CVE-2016-8776

Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the factory reset protection FRP to enter some functional modules without authorization and perform operations to update the Google account...

CVE-2016-8776

Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the factory reset protection FRP to enter some functional modules without authorization and perform operations to update the Google account...

Authorization

Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the factory reset protection FRP to enter some functional modules without authorization and perform operations to update the Google account...

CVE-2016-8776

Huawei CVE-2016-8776 affects P9 devices (EVA-AL10C00, EVA-CL10C00, EVA-DL10C00, EVA-TL10C00) and P9 Lite (VNS-L21C185) where Factory Reset Protection can be bypassed, allowing attackers to enter certain functional modules without authorization and perform Google account-related operations. The de...

CVE-2016-8776

Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the factory reset protection FRP to enter some functional modules without authorization and perform operations to update the Google account...

CVE-2017-0498

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

CVE-2017-0498

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

Denial of service

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

CVE-2017-0498

A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android I...

CVE-2017-0498

CVE-2017-0498 describes a denial-of-service condition in Android Setup Wizard that could let a local attacker force a Google account sign-in after a factory reset. Affected versions include Android 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1. The vulnerability is local in scope, with no exploitation detail...

Shopify: Authentication Bypass on monitoring server

Hello, This issue has the same impact as this one: 143482. But the fix is not complete, there is a shopify subdomain VPN server where you still can connect your google account. This should be hide and protected. So you guys need to change this so that only shopify.com Google accounts are accepted...