SMS Client

This module sends a text message to multiple phones of the same carrier. You can use it to send a malicious link to phones. Please note that you do not use this module to send a media file attachment. In order to send a media file, please use auxiliary/client/mms/sendmms instead. This module...

Taoyun Interactive Android app suffers from arbitrary password reset vulnerability

Tao Yun Interactive App is a children's learning and socialization app. Taoyun Interactive Android app has an arbitrary password reset vulnerability. It allows attackers to exploit the vulnerability to change the password of the other party by only requiring their cell phone number...

Happy Xiongbao Cloud Phone Watch Android app has arbitrary password reset vulnerability

Happy Xiongbao Cloud Phone Watch APP is an APP that works with the Happy Xiongbao Cloud Phone Watch hardware device. The Happy Xiongbao Cloud Phone Watch Android app has an arbitrary password reset vulnerability. It allows attackers to exploit the vulnerability to change the password of the other...

RealCaller Phone number lookup - Certificates or keys found, Dynamic Code Loading, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application RealCaller Phone number lookup published at the 'play' market has multiple vulnerabilities...

Free Phone Calls, Free Texting - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Free Phone Calls, Free Texting published at the 'play' market has multiple vulnerabilities...

CVE-2015-8768

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

Code injection

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

CVE-2015-8768

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

CVE-2015-8768

click/install.py in click does not require files in package filesystem tarballs to start with ./ dot slash, which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone...

CVE-2015-8768

The CVE concerns the Python-based Click package (install.py) where file names in tarballs are not required to start with ./, enabling a crafted package to bypass checks and install an alternate security policy, potentially elevating privileges. Affected component: click/install.py; context mentio...

Huawei Smart Phones Local Authentication Bypass Vulnerability

Huawei Nice is a smartphone from the Chinese company Huawei Huawei. A local authentication bypass vulnerability exists in Huawei Smart Phones. An attacker can flash or restore the phone to factory settings by following certain steps. Due to the lack of authentication in the "phone recovery"...

Security Advisory - Privilege Escalation Vulnerability in Huawei Smart Phones

There is a privilege escalation vulnerability in Huawei smart phones. An unauthenticated attacker can bypass phone activation to user management page of the phone and create a new user. Successful exploit could allow the attacker operate part function of the phone. Vulnerability ID:...

Polycom VVX Web Interface - Change Admin Password

Polycom VVX Web Interface - Change Admin Password Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html...

Security Advisory - Authentication Bypass Vulnerability in the 'Find Phone' Function of some Huawei Smart Phones

The 'Find Phone' function of some Huawei smart phones has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the...

Security Advisory - Authentication Bypass Vulnerability in the 'Find Phone' Function of some Huawei Smart Phones

The 'Find Phone' function of some Huawei smart phones has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the...

DOBBY Pocket Drone App for Android Arbitrary Password Reset Vulnerability

Zero Intelligent Control Beijing Intelligent Technology Co., Ltd. is committed to becoming the world's top supplier of intelligent aircraft products and intelligent drone total solutions.DOBBY Pocket Drone is one of the company's products. DOBBY Pocket Drone APP Android version has an arbitrary...

Security Advisory - Phone Finder Bypass Vulnerability in Huawei Smart Phones

Phone Finder is a Huawei security method that was designed to make sure someone can't just wipe and factory reset the phone if user lost it or it was stolen. The Phone Finder in some Huawei smart phones can be bypass. An attacker can bypass the Phone Finder by special steps and enter the System...

Ubiquiti Robotics Alpha2 Android app has arbitrary password reset vulnerability

Ubitus is a company that integrates artificial intelligence and humanoid robotics research and development, platform software development and utilization, and product sales. An arbitrary password reset vulnerability exists in the Ubitus Robotics Alpha2 Android app. The vulnerability allows an...

Beijing Evolver Robotics Fatty App Client Has Overstepping Vulnerabilities

Beijing Evolver Robotics Technology Co., Ltd. is engaged in the research and development of intelligent robots for home and commercial use, and has developed two versions of intelligent robots for home and commercial use, FABO. Beijing Evolver Robotics FABO app client has an overstepping...

3CX Phone System VAD_Deploy.aspx Arbitrary File Upload

An arbitrary file upload vulnerability exists in 3CX VoIP Phone System Manager. The vulnerability is due to failure to restrict file uploads in VADDeploy.aspx. A remote unauthenticated attacker can exploit this vulnerability by sending maliciously crafted requests to the target server...