Zenly: Friend Request Flow Exposes User Data

Summary: When submitting a friend request to a user, Zenly will allow access to their phone number regardless of whether the friend request is accepted or not. To obtain this information, a malicious actor only needs to know their username. Steps To Reproduce: To reproduce this issue, an...

Phone Shop Sales Managements System 1.0 Insecure Direct Object Reference

Exploit Title: Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference IDOR Date: 21/06/2021 Exploit Author: Pratik Khalane Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html Version:...

Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference (IDOR)

Exploit Title: Phone Shop Sales Managements System 1.0 - Insecure Direct Object Reference IDOR Date: 21/06/2021 Exploit Author: Pratik Khalane Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html Version:...

CVE-2021-33838

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration...

CVE-2021-33840

The server in Luca through 1.1.14 allows remote attackers to cause a denial of service insertion of many fake records related to COVID-19 because Phone Number data lacks a digital signature...

CVE-2021-33838

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration...

Design/Logic Flaw

The server in Luca through 1.1.14 allows remote attackers to cause a denial of service insertion of many fake records related to COVID-19 because Phone Number data lacks a digital signature...

CVE-2021-33838

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration...

CVE-2021-33840

The server in Luca through 1.1.14 allows remote attackers to cause a denial of service insertion of many fake records related to COVID-19 because Phone Number data lacks a digital signature...

New Study Warns of Security Threats Linked to Recycled Phone Numbers

A new academic study has highlighted a number of privacy and security pitfalls associated with recycling mobile phone numbers that could be abused to stage a variety of exploits, including account takeovers, conduct phishing and spam attacks, and even prevent victims from signing up for online...

U.S. General Services Administration: [Transportation Management Services Solution 2.0] Improper authorization at tmss.gsa.gov leads to data exposure of all registered users

Summary: Hi team! I hope you are having a great Tuesday : Where: https://tmss.gsa.gov/ Who: Unathenticated users Why: Improper Access Control at /tmssserver/api/public/customerregistration/:id/userId/ I found an endpoint /tmssserver/api/public/customerregistration/:id/userId/ at...

Fake-Sms - A Simple Command Line Tool Using Which You Can Skip Phone Number Based SMS Verification By Using A Temporary Phone Number That Acts Like A Proxy

A simple command line tool using which you can skip phone number based SMS verification by using a temporary phone number that acts like a proxy. Note-1: This is just an experimental tool, do not use this in any banking transactions. Unethical use of this tool is strictly not encouraged." Note-2:...

X (Formerly Twitter): PI leakage By Brute Forcing and Phone number deleting without using password

Summary: This additional security measure from twitter provides protection to the victim's account, considering that a victim's session may have been hijacked by a hacker, however, due to this additional layer of security Implemented by twitter the hacker would not be able to disclose the victim'...

Likely lead generation scam targets potential Malwarebytes MSP partners

Recently, Malwarebytes discovered a potential lead generation scam targeting companies that are interested in our Malwarebtyes Managed Service Provider MSP Program. In the scam, an individual who used the name “Jenny” aggressively contacted potential MSP partners claiming to represent Malwarebyte...

Scammers are spoofing bank phone numbers to rob victims

It can be a very convincing trick… “You can check the number in your display online sir. You’ll see I’m really calling from your bank.” That is, of course, if you are unaware that phone numbers can be spoofed. Then again, they wouldn’t be successful scammers if they weren’t convincing. If you...

Facebook hidden profile data disclosure Exploit

This lets you gather a bunch of information, even if it is private. phone number, email, ip-address, birthday, etc. Material can automatically collect data and save, possible to connect a proxy list...

TikTok: Information Disclosure of Advertiser Account on TikTok Ads Portal

In the TikTok Ads portal, if both invited Ad Accounts are part of the same business group, an exposed endpoint could potentially be exploited to view email address, phone number, company, and name of the Ad Account owner. We thank @emanuelharijanto for reporting this to our team and confirming th...

Mail.ru: Disclosure of the account email by phone number on [corporate.city-mobil.ru]

It was possible to obtain e-mail of the user registered in corporate.city-mobil.ru by phone number...

Moriarty-Project - This Tool Gives Information About The Phone Number That You Entered

What IS Moriarty? Advanced Information Gathering And Osint Tool Moriarty is a tool that tries to find good information about the phone number that you provieded; -Tries To Find Owner Of The Number -Tries To Find Risk Level Of The Number -Tries To Find Location,Time Zone Of The Number,Carrier -Tri...

Chamber Dashboard Business Directory < 3.3.1 - Authenticated Stored Cross-Site Scripting

The plugin does not sanitise user input when creating or editing a business in the dashboard, allowing high privilege users Editor+ to set XSS payloads in various fields. Login as an editor or admin, then add/edit a business and set the phone number as " The payload will then be executed in the...