PT-2017-15700

Name of the Vulnerable Software and Affected Versions Flash Seats Mobile App for Android versions 1.7.9 and earlier Flash Seats Mobile App for iOS versions 1.9.51 and earlier Description The issue is related to the failure of the Flash Seats Mobile App to properly validate SSL certificates provid...

Massive Breach Exposes Keyboard App that Collects Personal Data On Its 31 Million Users

In the digital age, one of the most popular sayings is—if you're not paying, then you're not the customer, you're the product. While downloading apps on their smartphones, most users may not realize how much data they collect on you. Believe me; it’s way more than you can imagine. Nowadays, many...

Kickbase Bundesliga Manager app for iOS plaintext transfer vulnerability

Kickbase Bundesliga Manager app for iOS is a soccer game app based on the iOS platform by German company Kickbase. A security vulnerability exists in versions of the Kickbase Kickbase Bundesliga Manager app for iOS based platforms prior to version 2.2.1, which stems from the program passing...

DDoS-for-Hire Service Launches Mobile App

In May 2013 KrebsOnSecurity wrote about Ragebooter, a service that paying customers can use to launch powerful distributed denial-of-service DDoS attacks capable of knocking individuals and Web sites offline. The owner of Ragebooter subsequently was convicted in 2016 of possessing child...

Eavesdropper Vulnerability Exposes Mobile Call, Text Data

UPDATE Mobile app developers who code using the Twilio cloud-based platform and are forgetful about removing their hardcoded credentials have put businesses messaging data at risk for exposure. The so-called Eavesdropper vulnerability, disclosed today by Appthority, has been around since 2011 and...

Logic design flaws in FeeControl Mobile App

FeeControl Mobile App is a mobile bookkeeping office software. There is a logical design vulnerability in FeeControl Mobile APP. An attacker can log into any account by grabbing packets and blasting the verification code...

Shinex Mobile App Has Logic Design Flaws

Credit Ease Mobile App is a software that helps credit managers to work efficiently. There is a logical design vulnerability in Xinyik Mobile APP. An attacker can log into any account system by capturing packets and bursting the verification code...

True Luck Driver Mobile App Has Logic Design Flaws

True Luck Driver Mobile App is a mobile application that helps truck drivers find work. There is a logical design vulnerability in the True Luck Driver mobile app. An attacker can log into any user account by using the forget password function to capture packet blasting to obtain the verification...

Microticket Mobile App Has Logic Design Flaws

Microticket Mobile App is an e-ticketing App developed by the R&D team of Beijing Microticket E-commerce Co. There is a logic design vulnerability in Microticket Mobile App. Attackers can utilize this vulnerability to replay the packets of sending CAPTCHA without restriction and bombard the clien...

WordPress mobile-app-builder-by-wappress arbitrary file upload vulnerability

WordPress mobile-app-builder-by-wappress is a mobile app development plugin for WordPress. An arbitrary file upload vulnerability exists in WordPress mobile-app-builder-by-wappress version 1.05, which originates from . The vulnerability stems from code in the...

Forbidden Horse Travel App has a logic design flaw

The Forbidden Horse Mobility App is a cell phone application for sharing motorcycles. There is a logic design loophole in Foramar Mobility APP, which allows attackers to arbitrarily register users or steal other users' account information for picking up a bike by grabbing packets and bursting...

Palm North App has multiple vulnerabilities

Palm Shang Beiguo APP is a comprehensive mobile media platform created by Shijiazhuang Beiren Group, which integrates online shopping, member services, e-membership, member e-wallet, integral activities, coupon issuance, parking, navigation, scheduling, seat selection and other services. There ar...

Design/Logic Flaw

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com...

CVE-2017-1002001

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com...

CVE-2017-1002001

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com...

CVE-2017-1002001

The CVE-2017-1002001 issue affects the WordPress plugin “mobile-app-builder-by-wappress” v1.05. CNVD/NVD detail an arbitrary file upload vulnerability stemming from the plugin’s server/images.php path, where authentication/permissions checks are not performed, enabling an attacker to upload arbit...

PT-2017-10990

Name of the Vulnerable Software and Affected Versions Mobile-App-Builder-by-Wappress version 1.05 Description The issue concerns the inclusion of unlicensed and vulnerable CMS software from http://www.invedion.com in the plugin. Recommendations For version 1.05, consider removing or disabling the...

CVE-2017-1002001: Unrestricted Upload of File with Dangerous Type

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com...

An Established Solution for Mobile Threats

As much as smartphones and applications have evolved over the years, so has mobile malware. We’re seeing an increasing number of threats—from mobile ransomware and auto-clicking adware to dangerous backdoors that can compromise your privacy. And there are also legitimate personal applications tha...

Information leakage vulnerability in Aliyun OSS credentials for Advanced Medical Examination BaoDian

Advanced Medical Exam App is a physician exam material application exam study question bank app. There is an information leakage vulnerability in the Medical Advanced Title Exam BaoDian AliCloud OSS credentials. The vulnerability is caused by credential leakage due to the use of SDK with...