Huawei Phone App Lock Bypass Vulnerability

Huawei Honor 7 Lite is a smartphone product of Huawei China. App Lock is a feature in the Phone Manager App that effectively prevents others from using apps on your phone without permission. An application lock feature bypass vulnerability exists on the Huawei Honor 7 Lite phone. An attacker can...

Security Advisory - App Lock Bypass Vulnerability in Huawei Mobile Phones

App Lock is a function provided by the Phone Manager app to prevent unauthorized use of apps on mobile phones. Some Huawei mobile phones have an App Lock bypass vulnerability. An attacker could perform specific operations to bypass the App Lock to use apps on a target mobile phone temporarily...

Mobile Menace Monday: Implications of Google Play Protect

Along with the recent release of Google’s new OS, Android 8.0 Oreo, they also released a new security suite known as Google Play Protect. As blogged about in July in Play Protect: Android’s new security system is now available, this new suite has been available since mid-May. To reiterate As note...

Is Your Mobile Carrier Your Weakest Link?

More online services than ever now offer two-step authentication -- requiring customers to complete a login using their phone or other mobile device after supplying a username and password. But with so many services relying on your mobile for that second factor, there has never been more riding o...

Charging Pile Android App Has Information Leakage Vulnerability

Charging Pile APP is a software that provides electric vehicle owners with information service on the location, number, type and status of charging piles. Charging Pile Android APP has information leakage vulnerability. By grabbing packets, the attacker can arbitrarily view user's name, cell phon...

Charging Pile Android App has Arbitrary Account Password Reset Vulnerability

Charging Pile APP is a software that provides electric vehicle owners with information service on the location, number, type and status of charging piles. Charging Pile Android APP has an arbitrary account password reset vulnerability. Allowing an attacker to reset a user's password by captcha...

CVE-2017-12857

Polycom SoundStation IP, VVX, and RealPresence Trio that are running software older than UCS 4.0.12, 5.4.5 rev AG, 5.4.7, 5.5.2, or 5.6.0 are affected by a vulnerability in their UCS web application. This vulnerability could allow an authenticated remote attacker to read a segment of the phone's...

Secure Mail for Windows unable to connect to the backend exchange server.

Secure Mail for WindowsPhone does not work when entering Credentials the App states "Access to your company network is not currently available" Android and iOS devices are working fine and are able to connect to Secure Mail. Direct native mail clients are accessible...

Shadow Collar Android app has information leakage vulnerability

Shadow Collar app is a mobile social forum client for imaging doctors. There is an information leakage vulnerability in Shadow Collar Android app. An attacker can use the vulnerability to reset any user's password, obtain user's name, cell phone number, email address and other information...

libgig Denial of Service Vulnerability

libgig is a C++ library for loading, modifying and creating Gigasamlier and DLS files. A denial of service vulnerability exists in the 'gig::DimensionRegion::CreateVelocityTable' function of the gig.cpp file in libgig version 4.0.0. A remote attacker can exploit this vulnerability to cause a deni...

Unikrn: Improper validation at Phone verification (possible cost increase + SMS SPAM attack)

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Please add the affected...

China Telecom's Care eTone for Android has logical design flaws

Based on China Telecom's CDMA network and "Wing Positioning" technology, Caring eTone is designed for middle and high-end users of Telecom to query the location information of their family members at any time through their Skywing 3G smartphones and to facilitate the search of information around...

Kandi Car Share Android app has an override access vulnerability

Car Sharing app is a new energy car time-sharing platform. The Kandi Car Sharing Android app suffers from an override access vulnerability. An attacker using this vulnerability can view arbitrary account information and disclose the user's name, ID number, and cell phone number...

Logic Design Vulnerability in Tlink IoT Cloud Service Platform Android App

TLINK Internet of Things is an open platform for Internet of Things products of Shenzhen Analog Technology Co. A logical design vulnerability exists in the Android App password recovery function of Tlink IoT cloud service platform. It allows the attacker to send unlimited SMS to the modified cell...

Left Neighborhood App Has Arbitrary User Password Reset Vulnerability

Left Neighbor APP is a virtual community service operation platform. Left Neighbor APP has an arbitrary user password reset vulnerability. An attacker can use this vulnerability to reset any user's password with just a cell phone number...

Worry-Free Electricity Android APP has Arbitrary Account Password Reset Vulnerability

Electricity Worry-free APP is a cross electrical equipment professional service platform. Electricity Worry-free Android APP has an arbitrary account password reset vulnerability. The vulnerability allows attackers to use the vulnerability to change the password of the other party's cell phone...

Denial of Service Vulnerability in Electricity Free Android App

Electricity Worry-free APP is a cross electrical equipment professional service platform. A denial of service vulnerability exists in the Electricity Worry Free Android APP. It allows an attacker to traverse a cell phone number and send unlimited CAPTCHAs to the cell phone, consuming server...

R7-2017-07: Multiple Fuze TPN Handset Portal vulnerabilities (FIXED)

This post describes three security vulnerabilities related to access controls and authentication in the TPN Handset Portal, part of the Fuze platform. Fuze fixed all three issues by May 6, 2017, and user action is not required to remediate. Rapid7 thanks Fuze for their quick and thoughtful respon...

Willow Police App Has Arbitrary Account Login Vulnerability

Liuzhou Police APP is a police information application platform launched by Liuzhou Municipal Public Security Bureau. Liuzhou Police APP has an arbitrary account login vulnerability. By means of CAPTCHA blasting, an attacker can log in to any account through a cell phone number...

Jiaxing Public Security App Has Arbitrary Account Login Vulnerability

Jiaxing Public Security APP is a convenient mobile application for local people in Jiaxing to find local services, mainly including motor vehicle violation inquiry, immigration office appointment, police news, security, police map, law enforcement public and other functional services. Jiaxing...