CVE-2019-9140 Happypoint mobile application information disclosure vulnerability

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

Shopify: Bypass of biometrics security functionality is possible in Android application (com.shopify.mobile)

Summary Shopify Android App has an option to sign in to the app using fingerprint. But if the application was open and someone triggers a "deeplink", authentication is no longer required. Step to Reproduce F523700 Link: Shopify Help Center - Topics - Products NOTE¹: The application must be open...

X (Formerly Twitter): Periscope android app deeplink leads to CSRF in follow action

Hello Twitter Team Summary This issue is mainly in the Periscope Android app against CSRF follow action using deeplink. Description In normal Periscope Website, when we share a follow link like www.pscp.tv//follow, we get a response whether to follow a person or not, giving us an option, means CS...

PayPal: [PayPal Android] Remote theft of user session using push_notification_webview deeplink

A deeplink feature built into the PayPal Android application failed to validate the requested endpoint. A specifically crafted request from a website or separate app on the device could call the deeplink and direct traffic to any destination. While the impact was limited by compensating controls,...

Grab: [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosure

A deeplink feature was found missing validation that led to sensitive information disclosure. Once triggered, the deeplink would direct users to load any attacker-controlled URL within a webview. The impact was further escalated as the webview contain sensitive information. A temporary patch was...

bookings.kulula.com XSS vulnerability

Vulnerable URL: http://bookings.kulula.com/ibe/deeplink/ancillary.do?PRO=http==F=V=ECAR=ECAR=T=CIA&DD1;=2015-07-23&AT1;=12:00:00=CIA&DD2;=2015-07-25&DT2;=12:00:00=1==1S=http://www.kulula.com/car-hire-booking=http://www.kulula.com/ Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017...

Unfixed XSS vulnerability at mediencenter.n24.de

Security researcher crucki, has submitted on 27/11/2011 a cross-site-scripting XSS vulnerability affecting mediencenter.n24.de, which at the time of submission ranked 8375 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/12/2011. It is...