Samsung SmartThings Hub video-core samsungWifiScan Callback Code Execution Vulnerability(CVE-2018-3867)

Summary An exploitable stack-based buffer overflow vulnerability exists in the samsungWifiScan callback notification of video-core's HTTP server of Samsung SmartThings Hub. The video-core process incorrectly handles the answer received from a smart camera, leading to a buffer overflow on the stac...

Samsung SmartThings Hub video-core Camera Update Code Execution Vulnerabilities(CVE-2018-3903 - CVE-2018-3904)

Summary Multiple exploitable buffer overflow vulnerabilities exist in the camera "update" feature of video-core's HTTP server of Samsung SmartThings Hub. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker...

Samsung SmartThings Hub video-core Camera Creation Code Execution Vulnerability

Summary An exploitable buffer overflow vulnerability exists in the camera “create” feature of video-core’s HTTP server of Samsung SmartThings Hub. The video-core process incorrectly extracts the “state” field from a user-controlled JSON payload, leading to a buffer overflow on the stack. An...

Samsung SmartThings Hub video-core Camera Update Code Execution Vulnerabilities

Summary Multiple exploitable buffer overflow vulnerabilities exist in the camera “update” feature of video-core’s HTTP server of Samsung SmartThings Hub. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. An attacker...

Samsung SmartThings Hub video-core Database shard.videoHostURL Code Execution Vulnerability

Summary An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core’s HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database, leading to a buffer overflow on th...

Code injection

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext...

CVE-2016-6546

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext...

CVE-2016-6546 iTrack Easy mobile application stores the user password in base-64 encoding/cleartext

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext...

mobile.linde-gase.de XSS vulnerability

Open Bug Bounty ID: OBB-634423 Description| Value ---|--- Affected Website:| mobile.linde-gase.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Mail.ru: XSS via message subject - mobile application

XSS in message compose window on forwarding message with crafted subject / sender name / content in mobile application for android...

Security Bulletin: IBM Worklight and IBM Mobile Foundation application authenticity bypass (CVE-2014-0888)

Summary IBM Worklight and IBM Mobile Foundation application authenticity verification can be bypassed under certain conditions. Vulnerability Details CVEID: CVE-2014-0888 DESCRIPTION: The application authenticity feature in IBM Worklight and IBM Mobile Foundation enables the Worklight server to...

Redis CVE-2018-12453 Remote Denial Of Service Vulnerability

Description Redis is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service condition. Redis version prior to 5.0 are vulnerable. Technologies Affected Redhat Ceph Storage 3 Redhat Mobile Application Platform 4 Redis Redis 2.8.21 Redis Red...

mobil.barclaycard.de XSS vulnerability

Open Bug Bounty ID: OBB-625159 Description| Value ---|--- Affected Website:| mobil.barclaycard.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

RHEL 7 : Red Hat Mobile Application Platform 4.6.0 (RHSA-2018:1263)

Red Hat Mobile Application Platform 4.6.0 release - RPMs Red Hat Mobile Application Platform RHMAP 4.6 is delivered as a set of container images. In addition to the images, several components are delivered as RPMs : OpenShift templates used to deploy an RHMAP Core and MBaaS The fh-system-dump-too...

Mobile Application Hacking Diary Ep.2

Mobile Application Hacking Diary Ep.2 |=--------------------------------------------------------------------=| |=------------= Mobile Application Hacking Diary Ep.2=--------------=| |=------------------------= 18 February 2018 =----------------------=| |=----------------------= By CWH Underground...

Nootka Command Injection Vulnerability

Nootka is a mobile application for learning classical music notation. A security vulnerability exists in Nootka 1.4.4 and earlier versions. A remote attacker can exploit the vulnerability to execute arbitrary operating system commands...

Photos in Wifi 1.0.1 - Path Traversal

Document Title: =============== Photos in Wifi 1.0.1 iOS - Path Traversal Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1600 Release Date: ============= 2018-01-04 Vulnerability Laboratory ID VL-ID: ===================================...

Wickr Inc - App Clock & Message Deletion Glitch P2

Document Title: =============== Wickr Inc - App Clock & Message Deletion Glitch P2 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2107 Document: https://www.vulnerability-lab.com/resources/documents/2107.rar Vulnerability Magazine:...

Wickr Inc - App Clock & Message Deletion Glitch P2

Document Title: =============== Wickr Inc - App Clock & Message Deletion Glitch P2 References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2107 Document: https://www.vulnerability-lab.com/resources/documents/2107.rar Vulnerability Magazine:...

Mail.ru: XSS на e.mail.ru в мобильном приложении!

Cross application scripting via message content in mobile mail application. Vulnerability affected a limited number of external domains connected in Mail.Ru mail application. Users of Mail.Ru mailboxes and largest mailbox providers were not affected, no access to confidential data was possible as...