2533 matches found
Hongyi Environmental Protection Android App Has Logic Design Flaws
Hongyi Environmental Android APP is an air purifier management tool. There is a logical design vulnerability in the Android APP of Hongyi Environmental Protection. Because the program fails to verify the verification code when performing registration, an attacker can bypass the verification code ...
Aier Eye Group's Eye Neighborhood Doctor's Edition App for Android Has Logic Design Flaws
Eye Neighborhood Doctor Edition App is an application designed and developed for ophthalmologists and ophthalmology practitioners. The Android version of Eye Neighborhood Doctor Edition APP of Aier Ophthalmology Group has a logic design vulnerability, which allows attackers to successfully regist...
Logic design flaws in the Android version of Eye Neighborhood App of Aire Eye Group
Eye Neighborhood APP is an all-round eye health management application, which monitors your eye health anytime and anywhere, consults with professional ophthalmologists online, and connects with offline eye health medical products to provide users with professional checkups and treatment services...
CVE-2017-10793
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...
Search Easy Borrowing App Exists with Arbitrary Password Reset Vulnerability
Search Easy Borrow APP is a smart loan search information service platform. There is an arbitrary password reset vulnerability in SearchEaseLendAPP, which allows an attacker to change the account password of the whole website in bulk by cooperating with the username enumeration...
Booking a Taxi for Faketoken
The Trojan-Banker.AndroidOS.Faketoken malware has been known about for already more than a year. Throughout the time of its existence, it has worked its way up from a primitive Trojan intercepting mTAN codes to an encrypter. The authors of its newer modifications continue to upgrade the malware,...
CVE-2017-12068
The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...
Uber: IDOR in activateFuelCard id allows bulk lookup of driver uuids
Due to an IDOR in the activateFuelCard endpoint, an attacker could enumerate driver UUIDs. When given a sequential card ID number, the endpoint returned a driver’s UUID given, allowing an attacker to gather many driver UUIDs for use in a different attack. Thanks, @cablej!...
Linux kernel information disclosure vulnerability (CNVD-2017-06927)
The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. An information disclosure vulnerability exists in the 'edgebulkincallback' function in the drivers/usb/serial/ioti.c file in Linux kernel versions 4.10.4 and earlier. A local...
Telecom's Campus Network Common Management Platform Has Overstepping Vulnerabilities
Telecom Campus Network Common Management Platform is a set of telecom campus network of China Telecom Group Corporation serving colleges and universities. An override vulnerability exists in the Telecom Campus Network Common Management Platform. The system fails to correctly verify user privilege...
Qualys Cloud Platform 2.26 New Features
This release of the Qualys Cloud Platform version 2.26 includes updates and new features for Cloud Agent, AssetView, Security Assessment Questionnaire and Web Application Scanning as follows: Highlights Cloud Agent Platform View Module Activation Job Status – adds a button in Agent Management tab...
XenMobile Rest API
XenMobile provides an extensive REST API that can be leveraged to extract data and provide it for business needs. This feature provides customers with the facility of calling XenMobile services using REST API. Instead of using XenMobile console, customers can call exposed services by using any RE...
Sendroid 5.2 - SQL Injection
Exploit Title: Sendroid - Bulk SMS Portal, Marketing v5.2 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy: https://codecanyon.net/item/sendroid-bulk-sms-portal-marketing-2way-messaging-script-with-mobile-app/14657225 Demo:...
Fome SMS Portal 2.0 SQL Injection
Exploit Title: Fome SMS Portal Advanced - Bulk SMS Reseller v2.0 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy: https://codecanyon.net/item/fome-sms-portal-advanced-bulk-sms-reseller-script/14241587 Demo:...
Sendroid 5.2 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Sendroid - Bulk SMS Portal, Marketing v5.2 Script - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://ynetinteractive.com/ Software Buy:...
XMS is unable to connect to DEP - Error: "Connection failed" when testing the connection
In the XMS console, inside iOS Bulk Enrollment DEP Configuration, when importing the Token file from the DEP Portal, the connectivity test is failing with error "Connection Failed". However, XMS connectivity tests are showing that XMS is able to reach Apple's websites, the ports are correctly...
Shopify: Open redirect in bulk edit
Hi , I have found an open redirection issue when bulk editing resources. PoC: Go to https://.myshopify.com/admin/bulk?resourcename=Product&returnto=/..//evil.com then click the Close button and you'll go to evil.com Thanks!...
Cybozu Mailwise contains issue in preventing clickjacking attacks
Overview Cybozu Mailwise contains multiple pages for editing/sending bulk emails. Some of these pages fail to protect against clickjacking attacks. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the...
JVN#04125292: Cybozu Mailwise contains issue in preventing clickjacking attacks
Cybozu Mailwise contains multiple pages for editing/sending bulk emails. Some of these pages fail to protect against clickjacking attacks. Impact If a user views a malicious page while logged in, the user may be tricked into conducting unintended operations. Solution Update the Software Update to...
