phonenumber: panic on parsing crafted RF3966 phonenumber inputs

Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...

SMShell - Send Commands And Receive Responses Over SMS From Mobile Broadband Capable Computers

PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers. This tool came as an insipiration during a research on eSIM security implications led by Markus Vervier, presented at Offensivecon 2023 Disclaimer This is not a complete C2 but rather...

CVE-2023-4916

CVE-2023-4916 affects the WordPress plugin Login with phone number . The root cause is missing nonce validation in the function lwp_update_password_action , enabling CSRF that allows unauthenticated attackers to change a user’s password if they can coerce an administrator into performing an actio...

CVE-2023-4916 Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...

WordPress plugin Login with phone number Cross-site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. The WordPress plugin Login with phone number suffer...

Jetpack CRM < 5.5.1 - Client+ XSS

Description The plugin does not sanitise and escape a client's phone number field, which could allow client users to perform Cross-Site Scripting attacks...

How to Remove Your Personal Info From Google by Using Its ‘Results About You’ Tool

You can now set up alerts for whenever your home address, phone number, and email address appears in Search...

SAMSUNG Mobile devices 输入验证错误漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile device SMR Jul-2023 Release 1 version, which originates from an incorrect input validation...

UPS warns customers of phishing attempts after data accessed

UPS Canada is warning customers in Canada of potential data exposure and the risk of phishing. People have started to receive letters like the one below from UPS, which some have assumed were "just" regular phishing alerts. As it turns out, the letter is specifically about the potential exposure ...

Temporary Phone Number: An Essential Tool for Privacy Protection

By Owais Sultan In an era where our lives are increasingly interconnected with the digital world, safeguarding our privacy has become… This is a post from HackRead.com Read the original post: Temporary Phone Number: An Essential Tool for Privacy Protection...

Malicious code in fc-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec30fba8ba38ae5e354c219234fb4dd78d71537718394caf3d584e896c5b0a42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-33291

In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. It cannot be exploited with e-mail addresses or phone numbers that are registered in the application...

CVE-2023-2706

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

Authentication flaw

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

CVE-2023-2706 OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

PT-2023-20921 · WordPress · Otp Login Woocommerce & Gravity Forms

Name of the Vulnerable Software and Affected Versions: OTP Login Woocommerce & Gravity Forms plugin for WordPress affected versions not specified Description: The OTP Login Woocommerce & Gravity Forms plugin for WordPress has an issue that allows authentication bypass. This happens because the...

OTP Login Woocommerce & Gravity Forms < 2.3 - Unauthenticated Privilege Escalation

The plugin returns generated OTP codes for users to use when using the logging in via phone number feature, allowing unauthenticated users to retrieve them for arbitrary accounts and be able to login as any user, including administrator granted they know the related phone number...

Unikrn: An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashier

Vulnerability description not provided...

Hackers can hijack Samsung and Pixel phones by knowing phone number

By Deeba Ahmed In addition to Google Pixel and Samsung devices, Vivo devices were also vulnerable to this attack. This is a post from HackRead.com Read the original post: Hackers can hijack Samsung and Pixel phones by knowing phone number...

Google Uncovers 18 Severe Security Vulnerabilities in Samsung Exynos Chips

Google is calling attention to a set of severe security flaws in Samsung's Exynos chips, some of which could be exploited remotely to completely compromise a phone without requiring any user interaction. The 18 zero-day vulnerabilities affect a wide range of Android smartphones from Samsung, Vivo...