Coolbike Android APP has arbitrary cell phone number login vulnerability

Coolbike Android APP is a mobile bike rental service software created by Shenzhen Venture Win Network Technology Co. Coolbike Android APP has an arbitrary cell phone number login vulnerability, allowing attackers to exploit the vulnerability to log in to their accounts with only another person's...

Bubai Bike Android APP has arbitrary cell phone number login vulnerability

Coolbike Android APP is a mobile bike rental service software created by Shenzhen Venture Win Network Technology Co. There is an arbitrary cell phone number login vulnerability in the Bai Bai Bicycle Android APP, allowing attackers to exploit the vulnerability to log in to their accounts with onl...

DOBBY Pocket Drone Android App Signature Has Arbitrary Password Reset Vulnerability

Zero Intelligent Control Beijing Intelligent Technology Co., Ltd. is committed to becoming the world's top supplier of intelligent aircraft products and intelligent drone total solutions.DOBBY Pocket Drone is one of the company's products. There is an arbitrary password reset vulnerability in the...

Arbitrary Password Reset Vulnerability in RideSmart Android App

Ride Free Android AP is a mobile application to keep your vehicle safe. Ride Carefree Android APP has an arbitrary password reset vulnerability that allows an attacker to exploit the vulnerability to change the password of the other party simply by knowing their cell phone number to gain access t...

Wise Dogs Android App Has Arbitrary Password Reset Vulnerability

Smart Home Dog Android App is an application about wireless access control intercom system,wireless smart home system. Smart Home Dog Android App has an arbitrary password reset vulnerability. Allow attackers only need to know each other's cell phone number to change their passwords, leaking...

Panasonic Smart Lock Android App Has Arbitrary Password Reset Vulnerability

Panasonic Smart Lock Android App is a smart hardware device. Panasonic Smart Lock Android App has an arbitrary password reset vulnerability. Allows an attacker to change the other party's password simply by knowing their cell phone number and obtain sensitive user information...

UBUNTU-CVE-2017-0334

An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions:...

UBUNTU-CVE-2016-8483

An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android...

Taoyun Interactive Android app suffers from arbitrary password reset vulnerability

Tao Yun Interactive App is a children's learning and socialization app. Taoyun Interactive Android app has an arbitrary password reset vulnerability. It allows attackers to exploit the vulnerability to change the password of the other party by only requiring their cell phone number...

Happy Xiongbao Cloud Phone Watch Android app has arbitrary password reset vulnerability

Happy Xiongbao Cloud Phone Watch APP is an APP that works with the Happy Xiongbao Cloud Phone Watch hardware device. The Happy Xiongbao Cloud Phone Watch Android app has an arbitrary password reset vulnerability. It allows attackers to exploit the vulnerability to change the password of the other...

TVer App for Android fails to verify SSL server certificates

Overview TVer App for Android provided by PRESENTCAST INC. fails to verify SSL server certificates. Yuto Iso of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attac...

Grab: Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App

Description: After my previous report about 2FA bypass on the Profile Edit endpoint i was interested to find enpoint, which will allow me horizontal privileges escalation. So, I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms which allow me to...

UBUNTU-CVE-2017-0434

An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the touchscreen chipset. This issue is rated as High because it first requires compromising a privileged process. Product: Android...

Business LaLa Call App for Android fails to verify SSL server certificates

Overview Business LaLa Call App for Android provided by K-Opticom Corporation fails to verify SSL server certificates. Yuto Iso of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

Grab: Two-factor authentication bypass on Grab Android App

Description I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/edit which allow me to bypass 2FA sms code due to lack of rate limiting\code expiration after unsuccessful attempts. The root cause of the problem it that facts: no rate limiting+ no code expiratio...

DOBBY Pocket Drone App for Android Arbitrary Password Reset Vulnerability

Zero Intelligent Control Beijing Intelligent Technology Co., Ltd. is committed to becoming the world's top supplier of intelligent aircraft products and intelligent drone total solutions.DOBBY Pocket Drone is one of the company's products. DOBBY Pocket Drone APP Android version has an arbitrary...

Ubiquiti Robotics Alpha2 Android app has arbitrary password reset vulnerability

Ubitus is a company that integrates artificial intelligence and humanoid robotics research and development, platform software development and utilization, and product sales. An arbitrary password reset vulnerability exists in the Ubitus Robotics Alpha2 Android app. The vulnerability allows an...

The Bank of Tokyo-Mitsubishi UFJ for Android vulnerable to SSL/TLS downgrade attack

Overview The Bank of Tokyo-Mitsubishi UFJ for Android may be exploited by SSL/TLS downgrade attack. The Bank of Tokyo-Mitsubishi UFJ for Android provided by The Bank of Tokyo-Mitsubishi UFJ, Ltd. tries to communicate with a server via TLS v1.2. However, when a response from the server indicates S...

Researchers Show How to Steal Tesla Car by Hacking into Owner's Smartphone

New technology is always a little scary, so are Smart Cars. From GPS system and satellite radio to wireless locks, steering, brakes, and accelerator, today vehicles are more connected to networks than ever, and so they are more hackable than ever. It's not new for security researchers to hack...

Xi'an Concert Hall App Payment Logic Vulnerability

Xi'an Concert Hall Android Client is a smartphone application that provides Xi'an Concert Hall performance inquiry and ticket purchase. A payment logic vulnerability exists in the Xi'an Concert Hall app. An attacker can modify the payment amount by bypassing the bank verification mechanism by...