Who is to blame for the malicious Barcode Scanner that got on the Google Play store?

In our last blog, Barcode Scanner app on Google Play infects 10 million users with one update, we wrote about a barcode scanner found on the Google Play store that was infected with Android/Trojan.HiddenAds.AdQR. All initial signs led us to believe that LavaBird LTD was the developer of this...

A Barcode Scanner App With Millions of Downloads Goes Rogue

After an update in December, the app began infecting Android devices, bombarding users with ads on their default browser...

Google Play Boots Barcode Scanner App After Ad Explosion

A barcode scanner app, with over 10 million downloads, was booted from the Google Play marketplace after users began to complain of mobile-ad overload. The makers of the app, called Barcode Scanner, intentionally altered the code of the app via an update turning it from a benign app to adware,...

Top Barcode Scanner app infected 10 million users with malware

By Deeba Ahmed The Barcode Scanner app with over 10 million installs has been removed by Google from Play Store after it was reported for malicious activities. This is a post from HackRead.com Read the original post: Top Barcode Scanner app infected 10 million users with malware...

A week in security (February 1 – February 7)

Last week on Malwarebytes Labs, we dug into a load of security events. We first peered into how Fonix ransomware was giving up the ghost, swearing off a life of crime and even apologizing for past actions. We looked at a credit card skimmer that found opportunity in the latest Magento 1 hacking...

CVE-2020-27260

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

CVE-2020-27260

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

Design/Logic Flaw

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

CVE-2020-27260

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

CVE-2020-13828

Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or...

PT-2020-13709 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 11.0.4 Description: The issue concerns multiple stored Cross-Site Scripting XSS vulnerabilities. These could allow remote authenticated attackers to inject arbitrary web script or HTML. This can be done via several API...

leptonica:barcode_fuzzer: Crash in sarrayAddString

Detailed Report: https://oss-fuzz.com/testcase?key=6278653881876480 Project: leptonica Fuzzing Engine: libFuzzer Fuzz Target: barcodefuzzer Job Type: libfuzzermsanleptonica Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7f474f571000 Crash State: sarrayAddString gplotAddPlot...

Barcode Reader Apps on Play Store Infected with Adware

By Deeba Ahmed The adware has the capability to disappear every 15 minutes to avoid detection. This is a post from HackRead.com Read the original post: Barcode Reader Apps on Play Store Infected with Adware...

CVE-2020-8792

The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid...

CVE-2020-8792

The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid...

CVE-2020-8792

The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid...

Malicious Package

Overview jmcnevin-rghost-barcode is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

CVE-2020-9385

A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in addon in upcean.c, when called from eanx in upcean.c during EAN barcode generation...

CVE-2020-9385

A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in addon in upcean.c, when called from eanx in upcean.c during EAN barcode generation...

Null pointer dereference

A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in addon in upcean.c, when called from eanx in upcean.c during EAN barcode generation...