OnePlus 3/3T open up an ADB session without authorization (CVE-2017-5622)

Last month we published CVE-2017-5626 patched in OxygenOS 4.0.2, a vulnerability which allowed attackers to effectively unlock a OnePlus 3/3T device without a factory reset. Combining this with our also discovered CVE-2017-5624 patched in OxygenOS 4.0.3 enabled a powerful attack against locked...

CVE-2017-5624

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...

Privilege escalation

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...

CVE-2017-5626: Undefined Security Weakness

OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands 4F500301 and 4F500302 that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code...

CVE-2016-3173

An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file e.g. an image which gets displayed at the portal application. Using script code at the file name leads t...

File Hub Input Validation Vulnerability

File Hub provides easy access to files on iOS Devices, Cloud Services and remote computers. An input validation vulnerability exists in File Hub. An attacker can inject malicious persistent code into the mobile application...

Google Offers Bug Bounty Vulnerability Research Grants

Google last week announced that it has instituted a program for 2015 in which researchers can receive up to 3,133.70 in grant money for bug hunting. Researchers must apply for the grants, which will be an up-front award that will be paid out before a bug is submitted, Google said. “Researchers’...

Supr Shopsystem 5.1.0 - Persistent UI Vulnerability

Exploit for php platform in category web applications Product & Service Introduction: =============================== SUPR is a modern and user-friendly system which allows each store very quickly and easily create their own online store. Without installation and own webspace you can begin to...

Woltlab Burning Board 3.9.1 - Persistent Encoding Issue

Document Title: =============== Woltlab Burning Board 3.9.1 - Persistent Encoding Issue References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1257 Video: https://www.youtube.com/watch?v=jNwS7gV7cQE Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1256 Release Date...

SonicWall UTM ES WAF - Input Filter Bypass Vulnerability

Document Title: =============== SonicWall UTM ES WAF - Input Filter Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=545 Release Date: ============= 2012-08-12 Vulnerability Laboratory ID VL-ID: ==================================== 54...

Zimbra 7.2 NE & OSE 7.2 GA - Multiple Web Vulnerabilities

Document Title: =============== Zimbra 7.2 NE & OSE 7.2 GA - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=581 Release Date: ============= 2012-06-14 Vulnerability Laboratory ID VL-ID: ==================================== 5...

Nimbuzz 2.2.0 Cross Site Scripting

Exploit Title: Nimbuzz 2.2.0 Cross Site Scripting Date: 09.04.2012 Author: Sony Software Link: http://www.nimbuzz.com/en/get/voip-and-chat-on-pc/pc-client-downloaded Software Version: 2.2.0 Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com...

Researchers unveil persistent BIOS attack methods

Apply all of the browser, application and OS patches you want, your machine still can be completely and silently compromised at the lowest level–without the use of any vulnerability. That was the rather sobering message delivered by a pair of security researchers from Core Security Technologies i...