CVE-2018-14650: Incorrect Permission Assignment for Critical Resource

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the...

sos-jeu.ch XSS vulnerability

Open Bug Bounty ID: OBB-641119 Description| Value ---|--- Affected Website:| sos-jeu.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

sos-fachportal.de XSS vulnerability

Open Bug Bounty ID: OBB-613585 Description| Value ---|--- Affected Website:| sos-fachportal.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

sos-debouchages.com XSS vulnerability

Open Bug Bounty ID: OBB-590314 Description| Value ---|--- Affected Website:| sos-debouchages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-12695

An Improper Authentication issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password...

CVE-2017-12697

A Man-in-the-Middle issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects to the server...

CVE-2017-9663

An Cleartext Storage of Sensitive Information issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow a remote attacker to access an encryption key that is stored in cleartext in memory...

Design/Logic Flaw

An Cleartext Storage of Sensitive Information issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow a remote attacker to access an encryption key that is stored in cleartext in memory...

CVE-2017-12695

CVE-2017-12695 affects the Shanghai OnStar iOS Client (GM SOS) version 7.1. The vulnerability is described as an Improper Authentication flaw that could allow an attacker to subvert security mechanisms and reset a user account password. Connected sources also reference related issues in the same ...

CVE-2017-12697

CVE-2017-12697 affects General Motors and Shanghai OnStar SOS iOS Client version 7.1. The connected documents describe a Man-in-the-Middle vulnerability where the client may transmit or validate data in a way that enables an attacker to intercept sensitive information when the client connects to ...

CVE-2017-9663

CVE-2017-9663 concerns a vulnerability in the General Motors (GM) and Shanghai OnStar SOS iOS Client (version 7.1) where a sensitive encryption key is stored in cleartext in memory. This cleartext storage of sensitive information could allow a remote attacker to access the key, with a CVSSv3 base...

CVE-2017-12697

A Man-in-the-Middle issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects to the server...

PT-2018-5440

Name of the Vulnerable Software and Affected Versions: General Motors GM and Shanghai OnStar SOS SOS iOS Client version 7.1 Description: An issue with improper authentication was found, which could allow an attacker to bypass security measures and reset a user's account password. Recommendations:...

PT-2018-5441

Name of the Vulnerable Software and Affected Versions: SOS iOS Client version 7.1 Description: A Man-in-the-Middle issue was discovered, which may allow an attacker to intercept sensitive information when the client connects to the server. Recommendations: For SOS iOS Client version 7.1, at the...

PT-2018-8520

Name of the Vulnerable Software and Affected Versions Shanghai OnStar SOS SOS iOS Client version 7.1 Description A Cleartext Storage of Sensitive Information issue was discovered, which may allow a remote attacker to access an encryption key stored in cleartext in memory. Recommendations For...

CVE-2017-9663: Cleartext Storage of Sensitive Information

An Cleartext Storage of Sensitive Information issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow a remote attacker to access an encryption key that is stored in cleartext in memory...

CVE-2017-12697: Channel Accessible by Non-Endpoint

A Man-in-the-Middle issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects to the server...

CVE-2017-12695: Improper Authentication

An Improper Authentication issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password...

sos-lekaren.sk XSS vulnerability

Open Bug Bounty ID: OBB-454152 Description| Value ---|--- Affected Website:| sos-lekaren.sk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Mozilla Secure Open Source security review published

Mozilla Secure Open Source security review published Earlier this year we were contacted by Mozilla and notified that our application to the Mozilla Secure Open Source program was accepted and that we would be receiving a review through the SOS program. The SOS program provides security auditing,...