CVE-2021-20728

Improper access control vulnerability in goo blog App for Android ver.1.2.25 and earlier and for iOS ver.1.3.3 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App...

The Malwarebytes 2021 State of Malware report: Lock and Code S02E04

This week on Lock and Code, we discuss the top security headlines generated right here on Labs. In addition, we tune in to a special presentation from Adam Kujawa about the 2021 State of Malware report, which analyzed the top cybercrime goals of 2020 amidst the global pandemic. If you just pay...

PT-2020-14105 · Threattrack · Vipre Password Vault

Name of the Vulnerable Software and Affected Versions: ThreatTrack VIPRE Password Vault app versions through 1.100.1090 for iOS Description: The issue is related to missing SSL certificate validation. Recommendations: For ThreatTrack VIPRE Password Vault app versions through 1.100.1090, update to...

MetaTrader 4 vs MetaTrader 5 iPhone app

By Owais Sultan If you are an online trading enthusiast, you can use MetaTrader 5 and MetaTrader 4 iPhone apps to trade forex. Though the prime objective of MetaTrader 4 iPhone app and MetaTrader 5 iPhone app is to enable users to have great trading experience, these forex trading apps vary in...

A week in security (March 18 – 24)

Last week on Malwarebytes Labs, we touched on the susceptibility of hospitals against phishing attacks, password reuse, the risk of interactive TV shows to side-channel attacks, and Facebook's new and out-of-character plan to promote privacy in the platform. Other cybersecurity news A study...

"an" App for iOS vulnerable to directory traversal

Overview "an" App for iOS provided by PERSOL CAREER CO., LTD. uses the old version of cordova-plugin-ionic-webview, and inherits a directory traversal vulnerability CWE-22, CVE-2018-16202. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this Vuerability to IPA. JPCERT/CC...

ANA App for iOS fails to validate SSL server certificate vulnerability

ANA App is an APP application. ANA App for iOS is vulnerable to a method-validated SSL server certificate vulnerability that could be exploited by an attacker to obtain and/or alter the content of a communication...

CVE-2018-0560

Hatena Bookmark App for iOS Version 3.0 to 3.70 allows remote attackers to spoof the address bar via vectors related to URL display...

CVE-2017-3190

Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

Vibease Wireless Remote Vibrator app for Android and Vibease Chat app for iOS vulnerabilities

Vibease Wireless Remote Vibrator app for Android is a wireless remote control app based on Android platform.Vibease Chat app for iOS is an online chat software based on iOS platform. A security vulnerability exists in the Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app f...

Gmail for iOS Adds Anti-Phishing Feature that Warns of Suspicious Links

Phishing — is an older style of cyber-attack but remains one of the most common and efficient attack vectors for attackers, as a majority of banking malware and various ransomware attacks begin with a user clicking on a malicious link or opening a dangerous attachment in an email. Phishing has...

TradeKing Forex for iPhone app for iOS Information Disclosure Vulnerability

TradeKing Forex for iPhone app for iOS is a highly customizable forex trading platform for iOS from TradeKing. A security vulnerability exists in version 1.2.1 of the TradeKing Forex for iPhone app for iOS, which is caused by the program failing to validate an X.509 certificate on the SSL server...

CVE-2017-9588

The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9575

The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9580

The "Pioneer Bank & Trust Mobile Banking" by PIONEER BANK AND TRUST app 3.0.0 -- aka pioneer-bank-trust-mobile-banking/id603182861 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2017-9591

The "PCB Mobile" by Phelps County Bank app 3.0.2 -- aka pcb-mobile/id436891295 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9587

The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Warner Bros. ellentube app for iOS authentication vulnerability

Warner Bros. ellentube app for iOS is an iOS-based video playback app from Warner Bros. An authentication vulnerability exists in versions 3.1.1 through 3.1.3 of the Warner Bros. ellentube app for iOS, which stems from the program's failure to validate an X.509 certificate on the server side of a...

CVE-2017-8939

The Warner Bros. ellentube app 3.1.1 through 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-8941

The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...