1855 matches found
Boozt Fashion AB: Cookie Misconfiguration
Hello, Great Day, I just want to Inform You that i Founded an Misconfiguration in your Website with android app. Steps to Reproduce ==================== 1.Login in to your Website https://www.boozt.com/login 2.Login with same account on android 3.Change Password ion Website 4.As You See That pass...
Gesture Lock Vulnerability in Your Money Management Android Client
You and I loan is an Internet financial investment platform. It provides users with convenient, low-threshold personal loans and investment services. There is a vulnerability in the gesture lock of YouMeLoan's financial management Android client, which allows attackers to bypass a layer of...
Renren Android client gesture lock vulnerability
Renren focuses on personal mortgage business and is committed to providing professional financial information services for individuals and small and medium-sized enterprises. A vulnerability in the gesture lock of Renren Caixuan's Android client allows an attacker to bypass a layer of...
Boozt Fashion AB: Android app does not use SSL for login
We tested the Android app, v2.0.2 To replicate: Install the app, and run it until you reach the login screen. Install PacketCapture: https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture Go to PacketCapture, go through setup, SKIP the SSL certificate install process Activate...
Acer Portal app for Android SSL Certificate Validation Vulnerability
Acer Portal app for Android is a suite of Android-based portals for registering Acer products from Acer. A security vulnerability exists in Acer Portal app for Android versions 3.9.3.2003 through 3.9.3.2006 that can be exploited by remote attackers to impersonate Acer Cloud and obtain user...
Nextcloud: Uploading files to a folder where invited user don't have any EDIT privilege
Hi, Any invited user to a shared folder with no edit privilege can create files in it through copy feature of Nextclod android app. Steps to reproduce it + Create any folder and invite a user in it without any edit privilege. + Now login from invited user account through android app. + Copy any...
Arrests Made In $45M Russian Bank Hack
Russian law enforcement has made 50 arrests in connection with a five-year operation to steal three billion rubles just shy of $45 million USD from the country’s largest bank, Sberbank. The hackers are alleged to have exploited websites, including popular news sites, to infect victims with the Lu...
kintone mobile for Android fails to verify SSL server certificates
Overview kintone mobile for Android provided by Cybozu, Inc. fails to verify SSL server certificates. Kusano Kazuhiko reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attack may allow an...
kintone mobile for Android information management vulnerability
Overview kintone mobile for Android provided by Cybozu, Inc. contains an authentication information management vulnerability. Kusano Kazuhiko and Gopinath reported this vulnerability to the developer. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...
More than 1 million People now access Facebook Over Tor Network
In Brief Facebook has hit another Milestone: More than 1 MILLION people, or you can say privacy conscious, are accessing Facebook over TOR. Facebook proudly announced today that, this month, for the first time, the people connected to the anonymous version of Facebook that's accessible only throu...
Cherish.com Android APP Man-in-the-Middle Attack Vulnerability
Cherish.com is a matchmaking site. A man-in-the-middle attack vulnerability exists in the Zhenai.com Android APP, where the software does not verify the validity of the TLS certificate when logging in, resulting in a man-in-the-middle that can use self-signed certificates to carry out an attack,...
TileMap - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application TileMap published at the 'play' market has multiple vulnerabilities...
Grim Legends - Base64 encoded String, Dynamic Code Loading, Exported components vulnerabilities
HackApp vulnerability scanner discovered that application Grim Legends published at the 'play' market has multiple vulnerabilities...
GPS Logger for Android - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities
HackApp vulnerability scanner discovered that application GPS Logger for Android published at the 'play' market has multiple vulnerabilities...
Chat Alternative — android app - External URLs, Native code usage, Runtime command execution vulnerabilities
HackApp vulnerability scanner discovered that application Chat Alternative — android app published at the 'play' market has multiple vulnerabilities...
Hide pictures - KeepSafe Vault - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities
HackApp vulnerability scanner discovered that application Hide pictures - KeepSafe Vault published at the 'play' market has multiple vulnerabilities...
Mandatos Android App - WebView SSL handling enabled, WebView code execution vulnerabilities
HackApp vulnerability scanner discovered that application Mandatos Android App published at the 'play' market has multiple vulnerabilities...
Remotely Exploitable Bug in Truecaller Puts Over 100 Million Users at Risk
Security researchers have discovered a remotely exploitable vulnerability in Called ID app "Truecaller" that could expose personal details of Millions of its users. Truecaller is a popular service that claims to "search and identify any phone number," as well as helps users block incoming calls o...
CVE-2016-1562
The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter...
CVE-2016-1562
The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter...