CVE-2019-5927

Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors...

Beijing Changping APP has overstepping access vulnerability

Beijing Changping app is an exclusive mobile news and information software for Beijing Changping area. Beijing Changping App has an override access vulnerability, which can be exploited by attackers to obtain information about other users...

SAP Business One Mobile App for Android Information Disclosure Vulnerability

SAP Business One Mobile App for Android is an Android-based enterprise resource planning application from SAP, Germany. The program includes business management, customer management and sales management. An information disclosure vulnerability exists in version 1.2.12 of the SAP Business One Mobi...

Facebook Paid Teens $20 to Install 'Research' App That Collects Private Data

If you are thinking that Facebook is sitting quietly after being forced to remove its Onavo VPN app from Apple's App Store, then you are mistaken. It turns out that Facebook is paying teenagers around $20 a month to use its VPN app that aggressively monitors their smartphone and web activity and...

New Relic: Bypass of #447975 - view mobile application token though "Application Information" sidebar on Installation page

In 447975 I demonstrated that it was possible to view the application token for a mobile app by visiting the upgrade page - this was subsequently fixed by disallowing access completely for a restricted user to view that page. I've found a workaround to this fix, and in doing so I've enable my...

Bluetooth Replay Vulnerability in LEM Smart Band S10

LEM smart bracelet is a smart bracelet produced by Shenzhen Lingmeng Technology Co., Ltd, which can collect the user's steps, blood pressure, heart rate and other health data, as well as set alarm reminders bracelet vibration and other functions. LEM Smart Bracelet S10 has a Bluetooth replay...

Soundtouch App Cross-Site Scripting Vulnerability

Soundtouch App is a mobile setup software for music speakers. A cross-site scripting vulnerability exists in Soundtouch App. An attacker can exploit the vulnerability to execute malicious javascript code in the user context...

New Relic: Upgrade menu exposes the mobile application token meant to only be visible to administrators

Usually, the restricted user is not able to view the mobile application token for a mobile app - the page that this token is visible on is only accessible to administrators. However - there exists a workaround to this if you are a restricted user and you still want to obtain this token - simply...

Here's How Hackers Could Have Spied On Your DJI Drone Account

Cybersecurity researchers at Check Point today revealed details of a potential dangerous vulnerability in DJI Drone web app that could have allowed attackers access user accounts and synced sensitive information within it, including flight records, location, live video camera feed, and photos tak...

Ghost hardware. Device No.3, the Ghost Rover

The Ghost Rover is a ghost hunting tank. You control it with a mobile app. We’ve looked at a toy spy tank before, it wasn’t great from a security point of view. Let’s hope our ghost-hunting tank – which, at $200, cost almost 4 time as much as the spy tank – has considerable security improvements ...

AES-Killer - Burp Plugin To Decrypt AES Encrypted Traffic Of Mobile Apps

Burpsuite Plugin to decrypt AES Encrypted mobile app traffic. Requirements Burpsuite Java Tested on Burpsuite 1.7.36 Windows 10 xubuntu 18.04 Kali Linux 2018 What it does Decrypt AES Encrypted traffic on proxy tab Decrypt AES Encrypted traffic on proxy, scanner, repeater and intruder How it works...

Anhui Yuanlu Information Technology Co., Ltd. deer Zhiyou APP there is information leakage vulnerability

Fawn Smart Tour is a smartphone tour guide software that provides hand-drawn maps of attractions, automatic positioning in scenic spots, and accompanied by vivid voice explanations, just like a tour guide on the go. CAPTCHA Design Vulnerability: This vulnerability mainly occurs when logging in,...

Official mobile version of Tor Browser released for Android – Download now

By Waqas There is good news for pro-anonymity web users who rely upon the Tor browser for using the internet. The first ever mobile browser app for the Tor browser has been released by the Tor Project, the organization behind the Tor network. The mobile version of the Tor browser is available for...

British Airways Website, Mobile App Breach Compromises 380k

British Airways said approximately 380,000 card payments were compromised after a security breach occurred on the company’s website and mobile app in August. According to the airline, which notified customers on Thursday, the breach compromised the personal and financial details of customers –...

British Airways Hacked – 380,000 Payment Cards Compromised

British Airways, who describes itself as "The World's Favorite Airline," has confirmed a data breach that exposed personal details and credit-card numbers of up to 380,000 customers and lasted for more than two weeks. So who exactly are victims? In a statement released by British Airways on...

British Airways Hacked – 380,000 Payment Cards Compromised

British Airways, who describes itself as "The World's Favorite Airline," has confirmed a data breach that exposed personal details and credit-card numbers of up to 380,000 customers and lasted for more than two weeks. So who exactly are victims? In a statement released by British Airways on...

You bet your mobile app consumers are willing to pay with their smartphone

For almost 10 years, there has been a debate over mobile app versus mobile web. Which strategy is right for your business and will consumers really ever buy something with a mobile device? Some of these questions have been clearly answered with time, but some aspects of the debate continue. The...

Threatpost News Wrap Podcast For Aug. 31

The Threatpost team breaks down the biggest news for the week ending on August 31. Topics covered are a Microsoft Windows zero-day, Yahoo’s recent acknowledgement that it scans emails to target ads to a report that mobile app SDKs capture private data when an Android or iOS app crashes. Download...

Beijing mobile app has information leakage vulnerability

Beijing Mobile APP is an official handheld client of Beijing Mobile. An information leakage vulnerability exists in Beijing Mobile APP. The vulnerability is caused due to the log file recording and storing login password information in plaintext, which can be exploited by an attacker to obtain...

Travel Breaches Hit Air Canada and Asia-Pac Hotelier

It’s been a busy week on the data breach front. First, Air Canada said that a breach of around 20,000 mobile app users had exposed passport information. At the same time, millions have been affected by an information heist targeting a Chinese hotel group with 3,500 properties across the...