OkCupid Dating App Flaws Could've Let Hackers Read Your Private Messages

Cybersecurity researchers today disclosed several security issues in popular online dating platform OkCupid that could potentially let attackers remotely spy on users' private information or perform malicious actions on behalf of the targeted accounts. According to a report shared with The Hacker...

Researchers Reveal New Security Flaw Affecting China's DJI Drones

Cybersecurity researchers on Thursday revealed security issues in the Android app developed by Chinese drone-maker Da Jiang Innovations DJI that comes with an auto-update mechanism that bypasses Google Play Store and could be used to install malicious applications and transmit sensitive personal...

Researchers Reveal New Security Flaw Affecting China's DJI Drones

Cybersecurity researchers on Thursday revealed security issues in the Android app developed by Chinese drone-maker Da Jiang Innovations DJI that comes with an auto-update mechanism that bypasses Google Play Store and could be used to install malicious applications and transmit sensitive personal...

Unauthorized Access Vulnerability in Dolphin Notebook Order Android APP of Beijing Smooth Entertainment Technology Co.

Dolphin Bookkeeping App is a professional and simple mobile bookkeeping software. There is an unauthorized access vulnerability in Dolphin Bookkeeping App for Android, which can be exploited by attackers to obtain sensitive information...

Unauthorized Access Vulnerability in Micro Sugar Android APP of Shanghai Geping Information Technology Co.

The Micro Sugar app is a mobile app that helps users manage their blood sugar. An unauthorized access vulnerability exists in Shanghai Geping Information Technology Co.'s Micro Sugar Android app, which can be exploited by attackers to obtain sensitive information...

Unauthorized Access Vulnerability in AA Travel Android APP of Shanghai Youheng Hotel Management Co.

AA Travel app is a hotel booking software. Shanghai Youheng Hotel Management Co., Ltd AA Travel Android App has an unauthorized access vulnerability, which can be exploited by attackers to obtain sensitive information...

Unauthorized Access Vulnerability in Time Sequence Android APP of Peanut Future (Guangzhou) Technology Co.

Time Sequence App is a schedule management software. Peanut Future Guangzhou Technology Co. Ltd Time Sequence APP for Android has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...

CVE-2020-5604

Android App 'Mercari' Japan version prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView...

CVE-2020-5604

Android App 'Mercari' Japan version prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView...

Directory traversal

MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILELIST" with a...

CVE-2020-5764

CVE-2020-5764 – MX Player Android App vulnerable versions: MX Player Android App earlier than v1.24.5. A directory traversal flaw exists in the MX Transfer feature when used in “Receive” mode. An attacker can act as a MX Transfer sender and send a FILE_LIST message with a name field containing di...

CVE-2020-5764

MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILELIST" with a...

CVE-2020-11882

The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle deeplinks that can be delivered either via links or by directly calling the activity. However, the deeplink format is not properly...

Shopify: STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend

I discovered a bug in an android mobile app that allowed STAFF No Permissions using Receipt Send to Mobile of any Order information in the Store. Steps to reproduce: 1 STAFF account is created and assigned "No Permissions" on a Shop by Owner/Admin 2 STAFF then login to shop. Notice that STAFF is...

My Adventures Hacking the iParcelBox

ARCHIVED STORY My Adventures Hacking the iParcelBox By Sam Quinn · June 18, 2020 In 2019, McAfee Advanced Threat Research ATR disclosed a vulnerability in a product called BoxLock. Sometime after this, the CEO of iParcelBox, a U.K. company, reached out to us and offered to send a few of their...

CVE-2019-16252

Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests, including login credentials and location data...

Mail.ru: ICQ Android APP remote DoS

Memory corruption issue on GIF image processing leads to ICQ for Android application crash with potential for code execution. before testing and reporting DoS conditions please check @mailru rules and scope description to avoid signal/reputation loss, not every DoS report is accepted...

CVE-2020-5572

Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an attacker to obtain credential information registered in the product via unspecified vectors...

EvilApp - Phishing Attack Using An Android App To Grab Session Cookies For Any Website (ByPass 2FA)

Man-in-the-middle phishing attack using an Android app to grab session cookies for any website, which in turn allows to bypass 2-factor authentication protection. EvilApp brings as an example the hijacking and injection of cookies for authenticated instagram sessions. Legal disclaimer: Usage of...

The vulnerability of the Microsoft Your Phone Companion App for Android, which involves authentication procedures that are flawed, allows unauthorized access to protected information and increases the privileges of attackers.

The vulnerability of the Microsoft Your Phone Companion App for Android, which is used for synchronizing and transferring files between the phone and a PC, is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to gain unauthorized access to...