2944 matches found
CVE-2019-16257
CVE-2019-16257 relates to SIMalliance Toolbox Browser (S@T Browser) on the UICC in some Motorola devices. The issue allows remote attackers to retrieve location and IMEI information, or other data and commands, via SIM Toolkit (STK) instructions in an SMS message (Simjacker). The Red Hat/NVD/NIST...
CVE-2019-16256
Some Samsung devices include the SIMalliance Toolbox Browser aka S@T Browser on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit STK instructions in an SMS message, aka Simjacker. Recent...
Flaws in Over Half a Million GPS Trackers Expose Children Location Data
What if the tech intended to ensure that your kids, senior citizens, and pets are safe even when they're out of sight inadvertently expose them to stalkers? An estimated 600,000 GPS tracking devices for sale on Amazon and other large online merchants for $25–$50 have been found vulnerable to a...
Joker Spyware Found in 24 Google Play Apps
A new spyware has been making the rounds in Android apps on Google Play, infecting victims post-download to steal their SMS messages, contact lists and device information. In addition to stealing victims’ information, the malware also stealthily signs them up for premium service subscriptions tha...
FunkyBot Malware Intercepts Android Texts, 2FA Codes
An Android malware dubbed “FunkyBot” has started making the scene in Japan, operated by the same attackers responsible for the FakeSpy malware. It intercepts SMS messages sent to and from infected devices. According to FortiGuard Labs, the malware named after logging strings found in the...
Twitter temporarily disables 'Tweeting via SMS' after CEO gets hacked
Twitter today finally decided to temporarily disable a feature, called 'Tweeting via SMS,' after it was abused by a hacking group to compromise Twitter CEO Jack Dorsey last week and sent a series of racist and offensive tweets to Dorsey's followers. Dorsey's Twitter account was compromised last...
Half of Android Handsets Susceptible to Clever SMS Phishing Attack
Over half of all Android handsets are susceptible to a clever over-the-air SMS phishing attack that could allow an adversary to route all internet traffic through a rogue proxy, as well as hijack features such as a handset’s homepage, mail server and directory servers for synchronizing contacts a...
Just An SMS Could Let Remote Attackers Access All Your Emails, Experts Warn
Beware! Billion of Android users can easily be tricked into changing their devices' critical network settings with just an SMS-based phishing attack. Whenever you insert a new SIM in your phone and connects to your cellular network for the very first time, your carrier service automatically...
QIWI: account takeover https://qiwi.me
It was possible to takeover user account by sending wrong code parameter in /sms/confirm request. Problem is that code didn't have relation with current user session...
WordPress booking-sms plugin cross-site scripting vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress booking-sms plugin. An attacker can exploit this...
Cisco IOS Short Message Service Denial of Service Vulnerability
According to its self-reported version, the installed Cisco IOS Software is affected by a vulnerability in its implementation of the Short Message Service SMS handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected device...
Cisco IOS XE Software Short Message Service Denial of Service Vulnerability
According to its self-reported version, the installed Cisco IOS XE Software is affected by a vulnerability in its implementation of the Short Message Service SMS handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service DoS condition on an affected...
CVE-2017-18555
The booking-sms plugin before 1.1.0 for WordPress has XSS...
CVE-2017-18555
The booking-sms plugin before 1.1.0 for WordPress has XSS...
Cross site scripting
The booking-sms plugin before 1.1.0 for WordPress has XSS...
CVE-2017-18555
The CVE-2017-18555 entry corresponds to a cross-site scripting (XSS) vulnerability in the WordPress Booking-SMS plugin. Multiple sources (Red Hat, CNVD, NVD, CVE lists) confirm that the vulnerability affects the Booking-SMS plugin before version 1.1.0 and can be triggered in user-controlled input...
CVE-2017-18555
The booking-sms plugin before 1.1.0 for WordPress has XSS...
CVE-2017-18495
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS...