WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin versions = 1.2.1. Solution Update the WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android...

WordPress WordApp Mobile App Plugin – Convert your WordPress Site to a Mobile App plugin <= 2.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WordApp Mobile App Plugin – Convert your WordPress Site to a Mobile App plugin versions = 2.0.3. Solution No patched version available...

WordPress Mobile App Editor – WordPress to Android App Builder plugin <= 1.1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Mobile App Editor – WordPress to Android App Builder plugin versions = 1.1.1. Solution Update the WordPress Mobile App Editor – WordPress to Android App Builder plugin to the latest available version a...

WordPress WordApp Mobile App Plugin – Convert your WordPress Site to a Mobile App plugin <= 2.0.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WordApp Mobile App Plugin – Convert your WordPress Site to a Mobile App plugin versions = 2.0.3. Solution No patched version available...

WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin <= 1.2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin versions = 1.2.1. Solution Update the WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin to the latest...

CVE-2021-43388

Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag in the manifest is False...

Hijacking smart luggage

When is a vulnerability not a vulnerability? I’m not sure this counts as a vuln per-se, but some easily-fixed and simple manufacturer mistakes result in trivial hijack of…. yes… your smart luggage. The Airwheel SR5 is the first smart luggage that we’ve seen. It can automatically follow the owner...

Design/Logic Flaw

Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application...

Information disclosure

Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables...

CVE-2020-36486

CVE-2020-36486 affects Swift File Transfer Mobile v1.1.2 and earlier. The vulnerability is a cross-site scripting (XSS) flaw triggered by the path parameter in the app’s list and download exception handling. The root cause is insufficient validation/escaping of the path input, allowing injected s...

Free BrewDog beer with a side order of shareholder PII?

TL;DR BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers Every mobile app user was given the same hard coded API Bearer Token, rendering request authorisation useless It was therefore trivial for any user to access any other...

Free BrewDog beer, with a side order of shareholder PII?

TL;DR BrewDog exposed the details of over 200,000 ‘Equity for Punks’ shareholders for over 18 months plus many more customers Every mobile app user was given the same hard coded API Bearer Token, rendering request authorisation useless It was therefore trivial for any user to access any other...

The Rise of One-Time Password Interception Bots

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords OTPs that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitor...

CVE-2021-41011

LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditions. This is usually impossible, but in combination with a server-side bug, attackers could get this information...

TechRadar app 跨站脚本漏洞

TechRadar app is a mobile software app. for displaying tech news, reviews and videos. The TechRadar app has a security vulnerability that stems from the application used for the Confluence server allowing XSS through the title field of the radar...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

ROS-2-845

2.845 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...

Security risks to your mobile app and how to avoid them

By Owais Sultan what are the most significant security risks to your mobile app? We’ve explained them below to help you avoid making the same mistakes. This is a post from HackRead.com Read the original post: Security risks to your mobile app and how to avoid them...

CVE-2021-27503

CVE-2021-27503 affects Ypsomed mylife Cloud (all versions before 1.7.2) and mylife App (before 1.7.5). The root cause is encryption at the application layer based on hard-coded secrets in the client–server protocol, which can enable man-in-the-middle tampering of messages. The Red Hat and other s...

CVE-2021-27491

Ypsomed mylife Cloud, mylife Mobile Application:Ypsomed mylife Cloud,All versions prior to 1.7.2,Ypsomed mylife App,All versions prior to 1.7.5,The Ypsomed mylife Cloud discloses password hashes during the registration process...