CVE-2019-14951

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as...

CVE-2019-9140

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

Information disclosure

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

CVE-2019-9140

CVE-2019-9140 affects Happypoint mobile app 6.3.19 and earlier, where processing of Deeplink schemes fails to validate the Deeplink URL, enabling potential javascript execution, URL redirection, and exposure of sensitive information when a user visits a crafted link. The connected documents corro...

Unpatched Flaws in IoT Smart Deadbolt Open Homes to Danger

UPDATE Researchers have uncovered vulnerabilities in a popular smart deadbolt could allow attackers to remotely unlock doors and break into homes. The manufacturer behind the smart lock, Hickory Hardware, has deployed patches to the affected apps on the Google Play Store and Apple App Store. The...

Post-Data Breach, British Airways Slapped With Record $230M Fine

UPDATE A record $230 million fine has been proposed against British Airways after a 2018 data breach impacted 500,000 of the airline’s customers. If approved, the fee would be the biggest General Data Protection Regulation GDPR fine to be issued to a company so far. On Monday, the Information...

The not so ultra lock

This post couldn't have been written without @evstykas and @cybergibbons. I became aware of the Ultraloq from U-tec a few months ago. For a room door lock it has a range of what look like really good features: Ultraloq UL3 smart lever lock is designed to be "Real Keyless". You are free to use...

CVE-2019-11334

An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources that are not otherwise accessible without proper authentication via capture-replay. Physically proximate attackers can use this informatio...

CVE-2019-10123

SQL Injection in Advanced InfoData Systems AIS ESEL-Server 67 which is the backend for the AIS logistics mobile app allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user...

CVE-2018-18975

An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backend servers because of a weak certificate-pinning implementation, leading to disclosure of medical information...

How Credit Unions Can Optimize & Secure the Mobile App Experience

A small army of digital natives are about to become the largest generation globally. Gen Z, those born after 1996, will account for 32% of the world's population 7.7 billion in 2019 and outnumber millennials for the first time, according to World Economic Forum. This year, it will be critical for...

Design/Logic Flaw

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

CVE-2019-11511

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

CVE-2019-11511

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

CVE-2019-11511

CVE-2019-11511 affects Zoho ManageEngine ADSelfService Plus, with an XSS flaw exposed via the mobile app API in builds prior to 5708. The vulnerability targets the mobile API path and can lead to script execution in the context of the user’s browser session. Affected component/file is the mobile ...

User are receiving mobile notifications of restricted Jira comments that they cannot view when accessing Jira through a browser

Hi Jira Server mobile app beta users, We recently discovered a bug where Jira Server mobile app users receive all comment notifications from Jira issues they’re watching or assigned to, even if the comment had been restricted to exclude them. This means they’ll be able to view the content of...

WordPress iOS App Bug Leaked Secret Access Tokens to Third-Party Sites

If you have a "private" blog with WordPress.com and are using its official iOS app to create or edit posts and pages, the secret authentication token for your admin account might have accidentally been leaked to third-party websites. WordPress has recently patched a severe vulnerability in its iO...

CVE-2019-6481

Abine Blur 7.8.2431 allows remote attackers to conduct "Second-Factor Auth Bypass" attacks by using the "Perform a right-click operation to access a forgotten dev menu to insert user passwords that otherwise would require the user to accept a second-factor request in a mobile app." approach,...

CVE-2017-2748

The CVE-2017-2748 entry concerns insecure (http) login transactions in early versions of the Isaac Mizrahi Smartwatch mobile app. Affected component: Isaac Mizrahi Smartwatch mobile app (iOS earlier versions; Android earlier versions). Root cause: use of unencrypted HTTP during login, enabling cr...

CVE-2017-2748

A potential security vulnerability caused by the use of insecure http transactions during login has been identified with early versions of the Isaac Mizrahi Smartwatch mobile app. HP has no access to customer data as a result of this issue...