Threatpost News Wrap Podcast For Aug. 31

The Threatpost team breaks down the biggest news for the week ending on August 31. Topics covered are a Microsoft Windows zero-day, Yahoo’s recent acknowledgement that it scans emails to target ads to a report that mobile app SDKs capture private data when an Android or iOS app crashes. Download...

Beijing mobile app has information leakage vulnerability

Beijing Mobile APP is an official handheld client of Beijing Mobile. An information leakage vulnerability exists in Beijing Mobile APP. The vulnerability is caused due to the log file recording and storing login password information in plaintext, which can be exploited by an attacker to obtain...

Travel Breaches Hit Air Canada and Asia-Pac Hotelier

It’s been a busy week on the data breach front. First, Air Canada said that a breach of around 20,000 mobile app users had exposed passport information. At the same time, millions have been affected by an information heist targeting a Chinese hotel group with 3,500 properties across the...

Air Canada Suffers Data Breach — 20,000 Mobile App Users Affected

Air Canada has confirmed a data breach that may have affected about 20,000 customers of its 1.7 million mobile app users. The company said it had "detected unusual log-in behavior" on its mobile app between August 22 and 24, during which the personal information for some of its customers "may...

Air Canada Suffers Data Breach — 20,000 Mobile App Users Affected

Air Canada has confirmed a data breach that may have affected about 20,000 customers of its 1.7 million mobile app users. The company said it had "detected unusual log-in behavior" on its mobile app between August 22 and 24, during which the personal information for some of its customers "may...

Security Glitch in IoT Camera Enabled Remote Monitoring

Swann has patched a flaw in its connected cameras that would allow a remote attacker to access their video feeds. A research team, consisting of Andrew Tierney, Chris Wade and Ken Munro from Pen Test Partners, as well as security researchers Alan Woodward, Scott Helme and Vangelis Stykas, develop...

Information Disclosure

moodle is vulnerable to information disclosures. A malicious student user can view quiz results without the proper permissions using the mobile web app...

CVE-2016-6547

The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file...

CVE-2016-6548 Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account...

CVE-2016-6547

The CVE-2016-6547 issue affects the Zizai Tech Nut mobile app, where the account password used to authenticate to the cloud API is stored in cleartext in the cache.db file. This creates a local information exposure risk, enabling a user with access to the device to retrieve sensitive credentials....

CVE-2016-6548

The CVE-2016-6548 entry concerns the Zizai Tech Nut mobile app, where HTTP requests leak the user’s authenticated session token in the URL. This exposes the session token to network-level observers, enabling potential account takeover since the token can be reused to access the user’s account. Th...

CVE-2016-6547 Zizai Tech Nut stores the account password in cleartext

The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file...

PT-2018-4948

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut mobile app affected versions not specified Description The issue concerns the storage of account passwords in cleartext within the cache.db file of the app, which is used for authentication to the cloud API. Recommendations At t...

PT-2018-4949

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut mobile app affected versions not specified Description The issue concerns the Zizai Tech Nut mobile app making requests via HTTP instead of HTTPS, which includes the user's authenticated session token in the URL. This allows an...

CVE-2016-6538

The TrackR Bravo app stores the account password for cloud authentication in cleartext in cache.db (affected in all reports). Affected versions are iOS 5.1.6 and Android 2.2.5; vendors released updates to address CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541. CVSS data indicate pa...

ANA App for iOS fails to verify SSL server certificates

Overview ANA App for iOS provided by ALL NIPPON AIRWAYS CO., LTD fails to verify SSL server certificates CWE-295. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact...

VIP.com Cross-Site Request Forgery Vulnerability

VIP.com application for IOS and Android is an online shopping application based on IOS and Android platforms by China Vipshop Information Technology Company. A security vulnerability exists in the VIP.com application for IOS and Android based platforms. A remote attacker can leverage a rogue acce...

I know where your pet is

Kaspersky Lab's many years of cyberthreat research would suggest that any device with access to the Internet will inevitably be hacked. In recent years, we have seen hacked toys, kettles, cameras, and irons. It would seem that no gadget has escaped the attention of hackers, yet there is one last...

Multiple vulnerabilities in Voice of the Customer App for Android

Voice of the Customer APP is a consulting service software for customers of Trina Solar Inc. Voice of Customer APP Android version has information leakage, email bombing, overstepping and resetting arbitrary account password vulnerabilities. The attacker can obtain the information of the register...

Moodle 3.x Privilege Escalation Vulnerability (Jan 2018) - Linux

Privilege escalation in quiz web services. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...