Mysterious malware that re-installs itself infected over 45,000 Android Phones

Over the past few months, hundreds of Android users have been complaining online of a new piece of mysterious malware that hides on the infected devices and can reportedly reinstall itself even after users delete it, or factory reset their devices. Dubbed Xhelper, the malware has already infected...

Unspecified Vulnerability in Apple macOS Catalina SharedFileList Component

Apple macOS Catalina is a specialized operating system developed by Apple for Mac computers.SharedFileList is one of the shared file list components. A security vulnerability exists in the SharedFileList component in Apple macOS Catalina versions prior to 10.15. The vulnerability can be exploited...

CVE-2019-11275

Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a na...

Design/Logic Flaw

An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine VM to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method...

Spyware App on Google Play Gets Boot, Returns Days Later

A music-streaming app offered on Google Play, harboring spyware that stole victims’ contacts, files and SMS messages, made its way onto the official Android app marketplace not once, but twice. The spyware was hidden in an app called Radio Balouch also known as RB Music. The app itself was actual...

Huawei P30, Mate 20 and P30 Pro Buffer Overflow Vulnerability

The Huawei P30, among others, is a smartphone from the Chinese company Huawei Huawei. A buffer overflow vulnerability exists in versions prior to Huawei P30 ELLE-AL00B 9.1.0.193 C00E190R1P21, Mate 20 Hima-AL00B 9.1.0.135 C00E200R2P1 and P30 Pro VOGUE-AL00A 9.1.0.193 A buffer overflow vulnerabilit...

Microsoft SharePoint Information Leakage Vulnerability

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. An information...

CVE-2019-5301

Huawei smart phones Honor V20 with the versions before 9.0.1.161C00E161R2P2 have an information leak vulnerability. An attacker may trick a user into installing a malicious application. Due to coding error during layer information processing, attackers can exploit this vulnerability to obtain som...

PT-2019-13828 · Samsung · Fotaagent

Name of the Vulnerable Software and Affected Versions: Samsung mobile devices with N7.x software Samsung mobile devices with O8.x software Samsung mobile devices with P9.0 software Description: The issue allows a malicious application to create privileged files through the FotaAgent component. Th...

Apple iOS and Apple tvOS Profiles Component Authorization Validation Vulnerability

Apple iOS and Apple tvOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple tvOS is an operating system for smart TVs. profiles is one of the profile components. A security vulnerability exists in the Profiles component of Apple iOS before 12.4 an...

CVE-2019-5222

There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216C00E214R2P1. The Secure Input does not properly limit certain system privilege. An attacker tricks the user to install a malicious application and successful...

CVE-2019-5305

The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159C185 has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could trigger double free and cause a...

CVE-2019-5214

There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.167C00E85R2P20T8. An attacker tricks the user into installing a malicious application, which make the software to reference memory after it has been freed...

CVE-2019-5216

There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156C00E156R2P14T8, Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156C00E156R1P20T8 and Honor Play smartphones versions earlier than Cornell-AL00A...

CVE-2019-5219

There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0.0.181C00E87R2P20T8. An attacker tricks the user into installing a malicious application, which makes multiple processes operate the same resource at the same time. Successful...

CVE-2019-5627

The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected BlueCats network implementation. The...

Authentication flaw

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

Default credentials

The Android mobile application BlueCats Reveal before 3.0.19 stores the username and password in a clear text file. This file persists until the user logs out or the session times out from non-usage 30 days of no user activity. This can allow an attacker to compromise the affected BlueCats networ...

Design/Logic Flaw

The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected BlueCats network implementation. The...

CVE-2019-5627 BlueCats Reveal iOS App Insecure Storage

The iOS mobile application BlueCats Reveal before 5.14 stores the username and password in the app cache as base64 encoded strings, i.e. clear text. These persist in the cache even if the user logs out. This can allow an attacker to compromise the affected BlueCats network implementation. The...