CVE-2017-6104

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

CVE-2017-6104

CVE-2017-6104 concerns the WordPress plugin Mobile App Native 3.0, where the file upload endpoint at zen-mobile-app-native/server/images.php accepts uploads without authentication and without validating the file content. The vulnerability allows an attacker to upload arbitrary files (e.g., PHP sh...

WordPress Mobile App Native 3.0 Shell Upload Vulnerability

WordPress Mobile App Native plugin version 3.0 suffers from a remote shell upload vulnerability. Title: Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0 Vulnerability Date: 2017-02-27 Download: https://wordpress.org/plugins/zen-mobile-app-native/ Vendor:...

PT-2017-16899

Name of the Vulnerable Software and Affected Versions Wordpress Plugin Mobile App Native version 3.0 Description A remote file upload issue exists. Recommendations For version 3.0, update to a newer version that contains a fix for this issue...

CVE-2017-6104: Improper Authentication

Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0...

Mobile App Native <= 3.0 - Remote File Upload

The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. PoC $ curl -F "file=@/var/www/shell.php"...

Mobile App Native <= 3.0 - Remote File Upload

The code in file ./zen-mobile-app-native/server/images.php doesn't require authentication or check that the user is allowed to upload content. It also doesn't sanitize the file upload against executable code. $ curl -F "file=@/var/www/shell.php"...

Kaspersky analyst: hackers can utilize APP vulnerability control smart cars-vulnerability warning-the black bar safety net

According to the British "Daily Mail" 2017 2 May 20 reported that the now more and more car owners by the car manufacturers provide a mobile app for your own car operate. However, Kaspersky Lab analysts have detected a large number of APP system vulnerabilities, hackers can by these vulnerabiliti...

Learn German. Speak German - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Learn German. Speak German published at the 'play' market has multiple vulnerabilities...

FLP360 Mobile App - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application FLP360 Mobile App published at the 'play' market has multiple vulnerabilities...

Google Android Products Qualcomm Bootloader Elevation of Privilege Vulnerability

Google Android is an operating system developed by Google for smartphones. Google Android Products Qualcomm Bootloader has a security vulnerability that allows remote attackers to exploit the vulnerability via a specially crafted application that can elevate privileges...

crea8social Mobile App - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application crea8social Mobile App published at the 'play' market has multiple vulnerabilities...

CARD.com Mobile - Customized SSL, Dangerous filesystem permissions, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application CARD.com Mobile published at the 'play' market has multiple vulnerabilities...

OAuth2. 0 deploy properly, billions of Android Apps account memory leak risk-vulnerability warning-the black bar safety net

The University of Hong Kong, three security researchers have found that many support single sign-on App no the correct deployment of OAuth2. 0 authentication Protocol, the attacker can use this vulnerability to remotely login to any user's App account. Ronghai Yang, Wing Cheong Lau and Tianyu Liu...

Over 1 Billion Mobile App Accounts can be Hijacked Remotely with this Simple Hack

Security researchers have discovered a way to target a huge number of Android and iOS apps that could allow them to remotely sign into any victim's mobile app account without any knowledge of the victim. A group of three researchers – Ronghai Yang, Wing Cheong Lau, and Tianyu Liu – from the Chine...

Wordpress plugin wordapp-mobile-app has multiple cross-site scripting vulnerabilities

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. Multiple cross-site scripting vulnerabilities exist in the Wordpress plugin wordapp-mobile-app. The program fails to filter user-supplied input, allowing an attacke...

Shopify: Able to Login deactivated staff account in shopify app mobile

Hi Shopify, Deactivated staff account is able to login in shopify mobile app. STEPS 1. Login your owner account 2. Go to Staff Accounts and deactivate your staff account 3. Login to your staff account in your shopify mobile app As you can see you were able to login even the staff account was...

Yelp: Requesting Show CheckIn Alert for Non Friend User

During analysis it was observed that I was able to request "ShowCheck In Alert" Request for non friend user. I performed this application from Mobile application. Below are the steps we have to carry to achieve this: Logged in to Yelp Mobile Application Visit any added friend and click on...

For a certain APP vulnerability discovery(capture+reverse=dig to the maximum vulnerability)-vulnerability warning-the black bar safety net

! Author: think twice journey Royalties：300RMB（not taking you to the contributor!） Submission methods: send an email to linwei3 6 0. cn, or visit the web version of the online submission Written on the front I learn penetration testing, mainly Web direction in a few months, and now was just getti...

For a certain APP vulnerability discovery(capture+reverse=dig to the maximum vulnerability)-vulnerability warning-the black bar safety net

Written on the front I learn penetration testing, mainly Web direction in a few months, and now was just getting started. Recall that learning vulnerability discovery process, in addition to watching some of the classic books, the most want to see is a large cattle were dug vulnerability of the...