EC Lite APP aliyun oss credentials have information leakage vulnerability

Aliyun Object Storage Service OSS is a massive, secure and highly reliable cloud storage service provided by Aliyun. An information disclosure vulnerability exists in EC Lite aliyun oss credentials. When using this SDK, the accessKeyId and accessKeySecret, endpoint are built into the mobile...

BeautyMakeupAPP aliyun oss credentials have information leakage vulnerability

Aliyun Object Storage Service OSS is a massive, secure and highly reliable cloud storage service provided by Aliyun. BeautyMakeup aliyun oss credentials are vulnerable to information disclosure. When using this SDK, accessKeyId and accessKeySecret, endpoint are built into the mobile app, leading ...

Code injection

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary...

CVE-2017-3214

The CVE-2017-3214 entry concerns the Milwaukee ONE-KEY Android app, where the master token is stored in plaintext inside the APK binary. Connected sources corroborate this as part of a broader set of findings in IoT security testing: the master credentials are needed to obtain a bearer token, whi...

CVE-2017-3215

CVE-2017-3215 affects the Milwaukee ONE-KEY Android app: it uses a bearer token with a one-year expiration that is stored on the device and, when combined with a user_id, can be used to perform user actions. Threat research notes the token can be reused if the phone is compromised, implying poten...

LBTC Mobile Information Disclosure Vulnerability

LBTC Mobile is a banking service that you can access anytime, anywhere. Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS The app fails to validate X.509 certificates for SSL servers, allowing man-in-the-middle attackers to spoof servers and gain access to sensitive information by...

Subaru car software vulnerability analysis—never a failure of token-vulnerability warning-the black bar safety net

Not long ago, one from California car, information security researcher Aaron Guzman, in Australia, held a computer security conference to introduce a black into the Subaru car of the method. In his own 2017 Subaru WRX STI was found in a surprising number of software vulnerabilities, through these...

CVE-2017-9558

The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

DIGIPASS® for Mobile Demo - Corrupted files, Runtime command execution, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application DIGIPASS® for Mobile Demo published at the 'play' market has multiple vulnerabilities...

FlashAir do not set credential information in PhotoShare

Overview FlashAir by Toshiba Corporation is an SDHC memory card which provides wireless LAN access functions. FlashAir PhotoShare function enables to share the image data in a certain folder with other users as it switches the original wireless LAN connection set by FlashAir default to the wirele...

TRT Çocuk Mobil - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application TRT Çocuk Mobil published at the 'play' market has multiple vulnerabilities...

Vulnerability in userid parameter of online customer service page of China Telecom's Palm Business Hall app.

China Telecom Pocket Business Office is a cell phone terminal-based application software that provides users with recharge and payment, cost inquiries and other services. The userid parameter in the online customer service page of China Telecom's Pocket Business Office app has an overstepping...

Android Package Inspector: Inspeckage

Inspeckage is a tool developed to offer dynamic analysis of Android applications. By applying hooks to functions of the Android API, Inspeckage will help you understand what an Android application is doing at runtime. Inspeckage will let you interact with some elements of the app, such as...

Super File Explorer 1.0.1 - File Upload Web Vulnerability

Document Title: =============== Super File Explorer 1.0.1 - File Upload Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2034 Release Date: ============= 2017-02-23 Vulnerability Laboratory ID VL-ID: ====================================...

Album Lock 4.0 iOS - Directory Traversal Vulnerability

Exploit for iOS platform in category web applications Document Title: =============== Album Lock v4.0 iOS - Directory Traversal Vulnerability Product & Service Introduction: =============================== Do you have any secret photo and videos in your iPhone? Album Lock can protect your privacy...

Wildix Collaboration Mobile - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Wildix Collaboration Mobile published at the 'play' market has multiple vulnerabilities...

Mobile Application Security Training Platform: Security Shepherd

The OWASP Security Shepherd project is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen...

OWASP Security Shepherd - Web And Mobile Application Security Training Platform

The OWASP Security Shepherd Project is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic. The aim of this project is to take AppSec novices or experienced engineers and sharpen...

CVE-2016-8329

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Mobile Application Platform. Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2016-8329

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products subcomponent: Mobile Application Platform. Supported versions that are affected are 8.54 and 8.55. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...