CVE-2021-34711

CVE-2021-34711 affects Cisco IP Phone software. A vulnerability in the debug shell allows an authenticated, local attacker to read arbitrary files on the device filesystem due to insufficient input validation. The issue is triggered by crafted input to a debug shell command. The impact is read ac...

CVE-2021-34711 Cisco IP Phone Software Arbitrary File Read Vulnerability

A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug she...

Cisco IP Phone Software Arbitrary File Read Vulnerability

A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug she...

CVE-2021-34711

A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug she...

Cisco IP Phone 路径遍历漏洞

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. A path traversal vulnerability exists in Cisco IP Phone that stems from insufficient input validation. An attacker can exploit this vulnerability by providing crafted input to...

TangleBot Android malware hijacks phone to steal login credentials

By Waqas Another day, another Android malware - This time it is called TangleBot malware whose entire modus operandi involves stealing your password. This is a post from HackRead.com Read the original post: TangleBot Android malware hijacks phone to steal login credentials...

FCC Proposal Targets SIM Swapping, Port-Out Fraud

The U.S. Federal Communications Commission FCC is asking for feedback on new proposed rules to crack down on SIM swapping and number port-out fraud, increasingly prevalent scams in which identity thieves hijack a targets mobile phone number and use that to wrest control over the victims online...

UPchieve: Missing Validation in editing "Your Phone Number"

Verification method is missing in changing "Your Phone Number" . There is no OTP or code send to new number for validating. POC video : recording-1632905982558.webm @thug645 Impact Misconfiguration...

SNKRDUNK Market Place App for iOS vulnerable to improper server certificate verification

Overview SNKRDUNK Market Place App for iOS provided SODA, Inc. is vulnerable to improper server certificate verification CWE-295. Okazawa Yoshihiro of Cryptography Laboratory , Information and Communication Engineering ,Graduate School of Engineering , Tokyo Denki University reported this...

A week in security (Sept 20 – Sept 26)

Last week on Malwarebytes Labs Freedom Hosting operator gets 27 years for hosting dark web abuse sites Microsoft makes a bold move towards a password-less future New Mac malware masquerades as iTerm2, remote desktop and other apps Internet safety tips for kids and teens: a comprehensive guide for...

September 27, 2021—KB5005619 (OS Build 20348.261) Preview

None None...

Oppo Android Phone with Qualcomm Chipset 安全漏洞

Oppo Android Phone with Qualcomm Chipset is an Android phone with Qualcomm chipset from Chinese company Oppo. Oppo Android Phone with Qualcomm Chipset suffers from a security vulnerability that stems from a third-party SDK that provides the ability to load third-party Providers...

Cross-site Scripting (XSS) - Reflected in opensourcepos/opensourcepos

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites Proof of Concept // PoC POST Request: https://demo.opensourcepos.org/messages/send/ Data:...

CVE-2021-21742

There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages...

CVE-2021-21742

CVE-2021-21742: The vulnerability affects ZTE’s mobile phone message service app (e.g., ZTE Axon 30 Pro) where improper parameter settings allow an information leak by accessing specific pages. The NVD entry notes a user-information leak with partial confidentiality impact and a separate local/pa...

CVE-2021-21742

There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages...

Google Report Spotlights Controversial ‘Geofence Warrants’ by Police

Newly released data by Google sheds light on a controversial practice called “geofence warrants”, which describes the practice of law enforcement requesting mobile phone data of users within close proximity of a crime. Google said, in an August report, the number of geofence warrants the company...

12 years jail for man who unlocked phones, defrauded AT&T of $200m

By Deeba Ahmed According to the US DoJ, Fahd remotely unlocked phones belonging to AT&T despite knowing that an investigation was launched against him. This is a post from HackRead.com Read the original post: 12 years jail for man who unlocked phones, defrauded AT&T of $200m...

AT&T Phone-Unlocking Malware Ring Costs Carrier $200M

The ringleader of a seven-year phone-unlocking and malware scheme will head to the clink for 12 years, according to the Department of Justice, after effectively compromising AT&T’s internal networks to install credential-thieving malware. The perp, one Muhammad Fahd of Pakistan and Grenada, was...

Nextcloud: User files is disclosed when someone called while the screen is locked

Summary: User files in the server is disclosed while the screen is locked when someone called. Steps To Reproduce: add details for how we can reproduce the issue 1. Make 2 Accounts, Lets call them Account A and Account B 2. Using Account A login to https://nextcloud/apps/spreed/ 3. Using Account ...