921 matches found
Yelp: Requesting Show CheckIn Alert for Non Friend User
During analysis it was observed that I was able to request "ShowCheck In Alert" Request for non friend user. I performed this application from Mobile application. Below are the steps we have to carry to achieve this: Logged in to Yelp Mobile Application Visit any added friend and click on...
For a certain APP vulnerability discovery(capture+reverse=dig to the maximum vulnerability)-vulnerability warning-the black bar safety net
! Author: think twice journey Royalties：300RMB（not taking you to the contributor!） Submission methods: send an email to linwei3 6 0. cn, or visit the web version of the online submission Written on the front I learn penetration testing, mainly Web direction in a few months, and now was just getti...
For a certain APP vulnerability discovery(capture+reverse=dig to the maximum vulnerability)-vulnerability warning-the black bar safety net
Written on the front I learn penetration testing, mainly Web direction in a few months, and now was just getting started. Recall that learning vulnerability discovery process, in addition to watching some of the classic books, the most want to see is a large cattle were dug vulnerability of the...
Abandoned Mobile C&C Servers Present Opportunity to Attackers
DENVER—When developers build mobile apps, they’re not only coding functionality, but they’re also dragging in third-party software development kits SDKs for ads, analytics and lots of things in between. A big function of SDKs is to communicate with a central server to receive instructions and...
Yelp Launches Public Bug Bounty
For a long time, Yelp.com has been one of the Internet’s most-frequented resources for crowd-sourced local business, restaurant and hospitality reviews and tips. Starting today, the door will be open to researchers and bug-hunters who are invited to participate in Yelp’s public bug bounty. The...
Instacart: API OAuth Public Key disclosure in mobile app
Our Android/iOS app can be decompiled and the OAuth Public token can be accessed. Contrary to Instacart's summary, the API private key is also leaked, allowing anyone to use Instacart's private API without restriction. Instacart which I have found to be great in general ignored my additional...
OLX: Full Account Takeover
Issue resolved by the OLX support , at the time of discovery of bug , olx.in was not in scope Whenever a user wants to login through the mobile app , the user enters his mobile number and then he is presented with a screen to enter the OTP . The problem is that there is no rate limiting on the...
Seeking Alpha Mobile Financial App Forgoes Encryption
A popular mobile application that provides financial market research material operates without a measure of encryption, putting user information, including credentials and strategic financial interests at risk. The Seeking Alpha mobile app for Android and iOS also leaks everything from HTTP cooki...
Google Updates CA Trust Mechanisms in Android Nougat
Google last week announced changes in the way it will handle trusted Certificate Authorities in Nougat, the latest version of the Android operating system. The changes are expected to cut into the likelihood of a successful man-in-the-middle attack, or a device falling victim to an...
Pwned by Vpon
Vpon is one of many mobile ad SDKs marketed towards mainland Chinese and Taiwanese developers and app users. Recently, FireEye mobile security researchers identified a branch of Vpon ad SDK on iOS containing code that allows a malicious actor be it the app developer or the SDK creator to remotely...
Breaking: Microsoft to buy LinkedIn for $26.2 BILLLLLION
Breaking News for today: Microsoft has announced that it is planning to acquire LinkedIn, the social network for professionals, for $26.2 Billion in cash. Yes, Microsoft announced today that it would buy LinkedIn for $196 per share in an all-cash transaction valued at $26.2 BILLLLLLION. It is so...
Perli Filter Bypass Vulnerability
Perli v2.6 iOS can be used to learn, run, and share perl scripts. A filter bypass vulnerability exists in the Perli iOS mobile app side. An attacker is able to inject malicious code in the affected module...
Pornhub: Weak user aunthentication on mobile application - I just broken userKey secret password
The researcher discovered a hard coded authentication bypass on the mobile app...
Secure Item Hub Persistent Input Validation Vulnerability
Secure Item Hub app is able to transfer files between iphone or ipad and computer on the same wifi network. A persistent input validation vulnerability exists in Secure Item Hub, which could allow a remote attacker to inject malicious persistent script code on the application side of the mobile a...
Authentication flaw
The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application...
info.laliveapps.com XSS vulnerability
Vulnerable URL:...
login.mainstreetapps.net XSS vulnerability
Vulnerable URL:...
Tokyo Star bank App Information Disclosure Vulnerability
Tokyo Star bank App for Android and iOS is a suite of banking apps for the Android and iOS platforms from Tokyo Star Bank in Japan. The Tokyo Star bank App for Android and iOS fails to validate server-side SSL certificates, allowing an attacker to exploit this vulnerability to conduct...
