CVE-2015-3888

Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers via spaces in a tel: URL...

CVE-2015-3888

CVE-2015-3888 affects Jolla Sailfish OS before 1.1.2.16. The issue is in the tel: URL handling, where spaces in the URL can be exploited to spoof the caller ID and trigger calls to arbitrary numbers. This is a remote defense/reachability concern for users and operators relying on accurate caller ...

Web Application Spider: BlackWidow

BlackWidow is a python based web application spider to gather subdomains, URL’s, dynamic parameters, email addresses and phone numbers from a target website. This project also includes Inject-X fuzzer to scan dynamic URL’s for common OWASP vulnerabilities. Features: Automatically collect all URL’...

HOT Man Android App Has Information Leakage Vulnerability

HOT Man Android APP is a mobile magazine software. There is an information leakage vulnerability in HOT Man Android APP. After registering and logging in to the system, an attacker can obtain sensitive information such as other users' UIDs, names, and cell phone numbers by clicking on "My Avatar"...

Xiaofeng Air Ching App for Android suffers from arbitrary account password reset vulnerability

Xiaofeng Air Dorje APP is the APP developed by Shenzhen Xiaofeng Technology Co., Ltd. to work with Xiaofeng Air Dorje system, mainly used to monitor the indoor air quality and Xiaofeng Air Dorje internal and external machine operation status, monitoring items including PM2.5, formaldehyde, oxygen...

HEYI Intelligent Alarm System Android APP has malicious bulk registration vulnerability

HEYI Smart Alarm System Android APP is a smart alarm APP that integrates security class monitoring, firmware upgrade, smart extension and so on. HEYI Smart Alarm System Android APP has a malicious bulk registration vulnerability, attackers can bulk register accounts by grabbing packet data to...

Malicious Bulk Registration Vulnerability in Bodivis Android APP of Tongfang Co.

The bodivis Android App is a healthy life management app for use with the bodivis Health Scale and Exercise Bracelet. There is a malicious bulk registration vulnerability in the bodivis Android APP of Tongfang Co. Attackers can bypass the authentication code and register accounts in bulk by...

Tweep - An Advanced Twitter Scraping Tool

Tweep is an advanced Twitter scraping tool written in python that allows for scraping Tweets and pictures from Twitter profiles without using Twitter's API. Benefits Some of the benefits of using Tweep vs Twitter API: Fast initial setup Can be used anonymously No rate limitations Can fetch all...

Flower Han App Has Logic Design Flaws

Flower Han is a cosmetic surgery and beauty community app. There is a logical design vulnerability in the Flower Han app that allows an attacker to register any user and reset a user's password by grabbing packets and modifying a cell phone number...

Arbitrary User Registration and Password Reset Vulnerability in Sapless App

The Paceless App is a software that provides cloud-based intelligent menstrual cycle data recording and analysis. There is an arbitrary user registration vulnerability in Snappy Worry-Free App, which allows an attacker to register any user and reset the user's password by catching packets and...

Hubei Radio and Television Station Yangtze River Cloud Android APP suffers from overstepping access vulnerability

Yangtze River Cloud Android APP is a news and information software created by Hubei Radio and Television Station, which integrates the three functions of government affairs, news and information, and life services. A vulnerability exists in the Hubei Radio and Television Changjiang Cloud Android...

Information Leakage Vulnerability in CTG's EZH Mobile APP

EZHI Mobile AP is a one-stop human resources services handheld application platform, covering personnel services, health management, flexible benefits and other business areas, providing online human resources services for registered users and the employees they serve. There is an information...

Hongyi Environmental Protection Android App Has Logic Design Flaws

Hongyi Environmental Android APP is an air purifier management tool. There is a logical design vulnerability in the Android APP of Hongyi Environmental Protection. Because the program fails to verify the verification code when performing registration, an attacker can bypass the verification code ...

Want to Go App has an overstepping loophole

Want to Go App is a shopping community that brings together good design and pure craftsmanship. There is an overstepping vulnerability in Wanna Go APP, which allows an attacker to obtain sensitive information about the seller, such as the merchant's cell phone number, by grabbing a packet after...

Cloud Inspection App for Android suffers from an override access vulnerability

Cloud Inspection is a scanning application authorized by the Entry-Exit Inspection and Quarantine Bureau, which allows you to find out the price, origin, date of entry, inspection and quarantine information of the goods. The Android version of the Cloud Inspection APP has an unauthorized access...

libgig Denial of Service Vulnerability

libgig is a C++ library for loading, modifying and creating Gigasamlier and DLS files. A denial of service vulnerability exists in the 'gig::DimensionRegion::CreateVelocityTable' function of the gig.cpp file in libgig version 4.0.0. A remote attacker can exploit this vulnerability to cause a deni...

Shadow Collar Android app has information leakage vulnerability

Shadow Collar app is a mobile social forum client for imaging doctors. There is an information leakage vulnerability in Shadow Collar Android app. An attacker can use the vulnerability to reset any user's password, obtain user's name, cell phone number, email address and other information...

Denial of Service Vulnerability in Electricity Free Android App

Electricity Worry-free APP is a cross electrical equipment professional service platform. A denial of service vulnerability exists in the Electricity Worry Free Android APP. It allows an attacker to traverse a cell phone number and send unlimited CAPTCHAs to the cell phone, consuming server...

R7-2017-07: Multiple Fuze TPN Handset Portal vulnerabilities (FIXED)

This post describes three security vulnerabilities related to access controls and authentication in the TPN Handset Portal, part of the Fuze platform. Fuze fixed all three issues by May 6, 2017, and user action is not required to remediate. Rapid7 thanks Fuze for their quick and thoughtful respon...

Wheat Home Edition Android App Has Override Access Vulnerability

Wheat Home Edition app is a video surveillance software that provides PV monitoring services. Wheat Home Edition Android App suffers from an override access vulnerability. Attackers can utilize the vulnerability to arbitrarily view sensitive information such as user's cell phone number, email...