Wordpress Plugin Mobile App Native Remote File Upload Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A remote file upload vulnerability exists in the Wordpress plugin Mobile App Native. Because the application fails to...

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0

./ zen-mobile-app-native/server/images.php code for missing authentication Mobile App WordPress plugin lets you turn your website into a full-featured mobile application in minutes using Mobile App Builder. Vulnerability: The code in the file ./ zen-mobile-app-native/server/images.php doesn't...

CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

Design/Logic Flaw

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

CVE-2017-6104

CVE-2017-6104 concerns the WordPress plugin Mobile App Native 3.0, where the file upload endpoint at zen-mobile-app-native/server/images.php accepts uploads without authentication and without validating the file content. The vulnerability allows an attacker to upload arbitrary files (e.g., PHP sh...

CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

WordPress Mobile App Native 3.0 Shell Upload Vulnerability

WordPress Mobile App Native plugin version 3.0 suffers from a remote shell upload vulnerability. Title: Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0 Vulnerability Date: 2017-02-27 Download: https://wordpress.org/plugins/zen-mobile-app-native/ Vendor:...

Mobile App Native <= 3.0 - Remote File Upload

The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. PoC $ curl -F "file=@/var/www/shell.php"...

Mobile App Native <= 3.0 - Remote File Upload

The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. $ curl -F "file=@/var/www/shell.php"...

Kaspersky analyst: hackers can utilize APP vulnerability control smart cars-vulnerability warning-the black bar safety net

According to the British "Daily Mail" 2017 2 May 20 reported that the now more and more car owners by the car manufacturers provide a mobile app for your own car operate. However, Kaspersky Lab analysts have detected a large number of APP system vulnerabilities, hackers can by these vulnerabiliti...

Learn German. Speak German - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Learn German. Speak German published at the 'play' market has multiple vulnerabilities...

FLP360 Mobile App - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application FLP360 Mobile App published at the 'play' market has multiple vulnerabilities...

Google Android Products Qualcomm Bootloader Elevation of Privilege Vulnerability

Google Android is an operating system developed by Google for smartphones. Google Android Products Qualcomm Bootloader has a security vulnerability that allows remote attackers to exploit the vulnerability via a specially crafted application that can elevate privileges...

crea8social Mobile App - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application crea8social Mobile App published at the 'play' market has multiple vulnerabilities...

CARD.com Mobile - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application CARD.com Mobile published at the 'play' market has multiple vulnerabilities...

OAuth2. 0 deploy properly, billions of Android Apps account memory leak risk-vulnerability warning-the black bar safety net

The University of Hong Kong, three security researchers have found that many support single sign-on App no the correct deployment of OAuth2. 0 authentication Protocol, the attacker can use this vulnerability to remotely login to any user's App account. Ronghai Yang, Wing Cheong Lau and Tianyu Liu...

Over 1 Billion Mobile App Accounts can be Hijacked Remotely with this Simple Hack

Security researchers have discovered a way to target a huge number of Android and iOS apps that could allow them to remotely sign into any victim's mobile app account without any knowledge of the victim. A group of three researchers – Ronghai Yang, Wing Cheong Lau, and Tianyu Liu – from the Chine...

Wordpress plugin wordapp-mobile-app has multiple cross-site scripting vulnerabilities

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Multiple cross-site scripting vulnerabilities exist in the Wordpress plugin wordapp-mobile-app. The program fails to filter user-supplied input, allowing an attacke...

Shopify: Able to Login deactivated staff account in shopify app mobile

Hi Shopify, Deactivated staff account is able to login in shopify mobile app. STEPS 1. Login your owner account 2. Go to Staff Accounts and deactivate your staff account 3. Login to your staff account in your shopify mobile app As you can see you were able to login even the staff account was...