WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin versions = 1.2.1. Solution Update the WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android...

WordPress WordApp Mobile App Plugin – Convert your WordPress Site to a Mobile App plugin <= 2.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WordApp Mobile App Plugin – Convert your WordPress Site to a Mobile App plugin versions = 2.0.3. Solution No patched version available...

WordPress Mobile App Editor – WordPress to Android App Builder plugin <= 1.1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Mobile App Editor – WordPress to Android App Builder plugin versions = 1.1.1. Solution Update the WordPress Mobile App Editor – WordPress to Android App Builder plugin to the latest available version at least 1.1.2...

CVE-2021-43388

Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag in the manifest is False...

Hijacking smart luggage

When is a vulnerability not a vulnerability? I’m not sure this counts as a vuln per-se, but some easily-fixed and simple manufacturer mistakes result in trivial hijack of…. yes… your smart luggage. The Airwheel SR5 is the first smart luggage that we’ve seen. It can automatically follow the owner...

Design/Logic Flaw

Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application...

Information disclosure

Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables...

CVE-2020-36486

CVE-2020-36486 affects Swift File Transfer Mobile v1.1.2 and earlier. The vulnerability is a cross-site scripting (XSS) flaw triggered by the path parameter in the app’s list and download exception handling. The root cause is insufficient validation/escaping of the path input, allowing injected s...

Free BrewDog beer with a side order of shareholder PII?

TL;DR BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers Every mobile app user was given the same hard coded API Bearer Token, rendering request authorisation useless It was therefore trivial for any user to access any other...

Free BrewDog beer, with a side order of shareholder PII?

TL;DR BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers Every mobile app user was given the same hard coded API Bearer Token, rendering request authorisation useless It was therefore trivial for any user to access any other...

The Rise of One-Time Password Interception Bots

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords OTPs that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitor...

TechRadar app 跨站脚本漏洞

TechRadar app is a mobile software app. for displaying tech news, reviews and videos. The TechRadar app has a security vulnerability that stems from the application used for the Confluence server allowing XSS through the title field of the radar...

ROS-2-845

2.845 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...

Security risks to your mobile app and how to avoid them

By Owais Sultan what are the most significant security risks to your mobile app? We’ve explained them below to help you avoid making the same mistakes. This is a post from HackRead.com Read the original post: Security risks to your mobile app and how to avoid them...

CVE-2021-27503

CVE-2021-27503 affects Ypsomed mylife Cloud (all versions before 1.7.2) and mylife App (before 1.7.5). The root cause is encryption at the application layer based on hard-coded secrets in the client–server protocol, which can enable man-in-the-middle tampering of messages. The Red Hat and other s...

Ypsomed mylife App 信任管理问题漏洞

Ypsomed mylife App is an application of Ypsomed AG. To optimize communication between people with diabetes and healthcare professionals, mylife Therapy Management is an easy-to-use, easy-to-share solution for diabetes therapy data. mylife App is vulnerable to a trust management issue, which stems...

SQL Injection Vulnerability in Tongxin Mobile App

Guangzhou Tongxin Technology Co., Ltd. is a high-tech joint-stock company specializing in human resources management system, eHR/OA integrated wisdom cloud platform, smart card cloud platform, industry software development and customization, intelligent enterprise management information technolog...

PT-2021-15269

Name of the Vulnerable Software and Affected Versions Nextcloud iOS versions prior to 3.4.2 Description The issue arises when searches for sharees utilize the lookup server by default, instead of only on the local Nextcloud server, unless a global search has been explicitly chosen by the user. Th...

PT-2021-3116 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions 3.10 to 3.10.3 Description: The issue is related to insufficient input validation in the virtual learning environment. It may allow a remote attacker to gain unauthorized access to protected information. The last time a user...

Code injection

Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application through 4.9.2 on Android and through 4.9.1 on iOS allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring th...