Samsung SmartThings Access Control Error Vulnerability

Samsung SmartThings is a powerful Samsung smart home mobile app from Samsung South Korea.An access control error vulnerability exists in versions prior to Samsung SmartThings 1.7.85.25. The vulnerability stems from improper access control and can be exploited by local attackers to bypass login...

Samsung mobile ScanPool Information Disclosure Vulnerability (CNVD-2022-67279)

Samsung mobile is a cell phone from Samsung South Korea. Samsung mobile ScanPool is vulnerable to an information disclosure vulnerability that results from a configuration error in the network system or product during operation. A local attacker could use this vulnerability to obtain MAC address...

Samsung mobile PersonaManagerService authorization issue vulnerability

Samsung mobile is a cell phone from Samsung South Korea. Samsung mobile PersonaManagerService is vulnerable to an authorization issue that stems from improper permission management in addAppPackageNameToAllowList, which can be exploited by local attackers to A local attacker can use the...

Samsung mobile SECRIL input validation error vulnerability (CNVD-2022-67280)

Samsung mobile is a cell phone from Samsung South Korea. Samsung mobile SECRIL is vulnerable due to a faulty input validation check logic in SECRIL. An attacker could use this vulnerability to trigger a crash...

CVE-2022-23169 Amodat - Mobile Application Gateway SQL Injection (SQLi)

attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel...

CVE-2022-23167 Amodat - Mobile Application Gateway Local File Inclusion (LFI)

Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED...

CVE-2022-1969

The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the adminupdatedata function. This makes it possible for unauthenticated attackers to inject malicious...

CVE-2022-1969 Mobile browser color select <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the adminupdatedata function. This makes it possible for unauthenticated attackers to inject malicious...

CVE-2022-1969 Mobile browser color select <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the adminupdatedata function. This makes it possible for unauthenticated attackers to inject malicious...

WordPress plugin Mobile browser color select 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Amodat Mobile Application Gateway SQL注入漏洞

Amodat Mobile Application Gateway, a mobile application gateway from Amodat Israel, is vulnerable to a SQL injection vulnerability in versions prior to 7.12.00.09, which stems from the username parameter in the login panel Lack of validation of externally entered SQL statements. An attacker could...

Amodat Mobile Application Gateway 安全漏洞

Amodat Mobile Application Gateway is a mobile application gateway from Amodat Israel. A security vulnerability exists in Amodat versions prior to 7.12.00.09, which can be exploited by an attacker to read sensitive files on the system...

HUAWEI EMUI 安全漏洞

HUAWEI EMUI and Magic UI is an Android-based mobile operating system developed by the Chinese company Huawei HUAWEI. HUAWEI EMUI and Magic UI suffers from an authorization issue vulnerability that stems from a lack of authorization in a system component, which can be exploited by an attacker to...

Samsung Account Information Disclosure Vulnerability (CNVD-2022-81377)

Samsung Account is a comprehensive free membership to Samsung services for Samsung mobile devices that can be used on smartphones, tablets, websites, TVs and other devices.An information disclosure vulnerability exists in versions prior to Samsung Account 13.2.00.6, which stems from the exposure ...

Coffee app in hot water for constant tracking of user location

A mobile app violated Canadas privacy laws via some pretty significant overreach with its tracking of device owners. The violation will apparently not bring the app owners, Tim Hortons, any form of punishment. However, the fallout from this incident may hopefully serve as a warning to others with...

Samsung Account Information Disclosure Vulnerability (CNVD-2022-70748)

Samsung Account, an account feature for Samsung mobile devices, is vulnerable to information disclosure in versions prior to Samsung Account 13.2.00.6. The vulnerability stems from a lack of proper protection of Samsung Account, which could be exploited to access sensitive information via...

H3C Magic R100 缓冲区错误漏洞

H3C Magic R100 is a router from H3C.A buffer overflow vulnerability exists in the H3C Magic R100 R100V100R005 version, which stems from a buffer overflow issue in the SetMobileAPInfoById parameter of the /goform/aspForm page. No detailed vulnerability details are currently available...

Fortinet FortiToken Mobile 信任管理问题漏洞

Fortinet FortiToken Mobile is an Oath-compliant, event-based and time-based one-time password Otp generator application from U.S.-based Fortinet. A security vulnerability exists in Fortinet FortiToken Mobile that originates from incorrect certificate validation. A remote attacker could exploit th...

SonicWall Secure Mobile Access (SMA) 12.4.x < 12.4.1-02994 Multiple Vulnerabilities (SNWLID-2022-0009)

The remote host is a SonicWall Secure Mobile Access SMA device that may be affected by multiple vulnerabilities: - SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key to store data. CVE-2022-1701 - SonicWall SMA1000 series firmwa...

CVE-2022-31470

An XSS vulnerability in the indexmobilechangepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session for a logged-in user, can access and retrieve mailbox content...