Beijing Tianying Jiuzhou Network Technology Co., Ltd. flipping novels APP there are logic flaws vulnerability

Flip Novel App is a reading app that allows you to read original novels. Beijing Tianying Jiuzhou Network Technology Co., Ltd Flip Novel APP has a logic flaw vulnerability. Attackers can use the vulnerability to arbitrarily bind other people's cell phone numbers that are not bound to the APP and...

Mail.ru: Брутфорс sms кода подтверждения для смены номера телефона в аккаунте LootDog.

SMS code for phone number change in lootdog.io was not sufficiently protected against bruteforce...

CVE-2019-18223

ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the 1 User Edit or 2 User Add form, 3 name field in the Role Add form, 4 name or number field in the Edit Group form, 5 tagKey or tagValue field in the Recording Rul...

Phonia Toolkit - One Of The Most Advanced Toolkits To Scan Phone Numbers Using Only Free Resources

Phonia Toolkit is one of the most advanced toolkits to scan phone numbers using only free resources. The goal is to first gather standard information such as country, area, carrier and line type on any international phone numbers with a very good accuracy. Getting started Phonia installation cd...

CVE-2020-2597

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite component: Call Phone Number Page. Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to...

X (Formerly Twitter): Bypass Password Authentication for updating email and phone number - Security Vulnerability

Summary: Additional requirement for authentication is an extra layer of security for a person's Twitter account. Instead of only entering the password at the time of log in, twitter further Introduces additional layer of security by prompting users to enter their password before attempting to...

Code injection

Bulb Security Smartphone Pentest Framework SPF before 0.1.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddressTB parameter to 1 remoteAttack.pl or 2 guessPassword.pl in frameworkgui/; the filename parameter to 3 CSAttack.pl or 4 SEAttack.pl in...

Starbucks: India - OTP bypass on Phone number verification for account creation

dekster discovered a mobile number verification bypass via incorrect client side validation allowing an attacker to validate a new account creation without a valid phone number attached. @dekster — thank you for reporting this vulnerability and for confirming the resolution...

Razer: [Razer Pay] Broken Access Control at /v1/verifyPhone/ allows enumeration of usernames and ID information

The tester discovered an API endpoint with insufficient access control that could allow an adversary to obtain user name and phone number information. Razer Fintech thanks the tester for his clear PoC and diligence in helping us secure our customers' information...

New WhatsApp Bug Could Have Let Hackers Secretly Install Spyware On Your Devices

The recent controversies surrounding the WhatsApp hacking haven't yet settled, and the world's most popular messaging platform could be in the choppy waters once again. The Hacker News has learned that last month WhatsApp quietly patched yet another critical vulnerability in its app that could ha...

Design/Logic Flaw

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS...

Mail.ru: [pandao.ru] possibility to attach arbitrary phone number to account registered via social network

It was possible to attach an arbitrary unregistered phone number to account registered via different id e.g. social network id. This behavior can prevent user from registering with his phone number and facilitate phishing attack if victim attempts to login by phone number...

Login Bypass Vulnerability in Xianqi Kindergarten Online Management System

Xianqi Kindergarten Online Management System is a professional and easy-to-use kindergarten online management system that supports real-time synchronization of data between smartphone APP and computer. There is a login bypass vulnerability, which can be exploited by attackers to login the system...

Twitter temporarily disables 'Tweeting via SMS' after CEO gets hacked

Twitter today finally decided to temporarily disable a feature, called 'Tweeting via SMS,' after it was abused by a hacking group to compromise Twitter CEO Jack Dorsey last week and sent a series of racist and offensive tweets to Dorsey's followers. Dorsey's Twitter account was compromised last...

CVE-2019-15870

The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field...

Cross site scripting

The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field...

CVE-2019-15870

The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field...

Telegram Information Disclosure Vulnerability

Telegram is an instant messaging mobile application. An information disclosure vulnerability exists in the Privacy Phone Number feature in Telegram version 5.10, which can be exploited by unauthorized attackers to obtain sensitive information about affected components...

CVE-2019-15514

The Privacy Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers...

CVE-2019-15514

The Privacy Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers...