Learn from the T-Mobile API Breach to Improve Your API Security Program in 2023

A CISO’s job has never been more challenging. Engineering teams move fast, especially as organizations are accelerating their digital transformation efforts. The tech stack is exploding and varies greatly across the organization. And there is a surge of internal, external, and partner APIs. It’s...

HCL Technologies BigFix Mobile/Modern Client Management 安全漏洞

HCL Technologies BigFix Mobile/Modern Client Management is a mobile device management software client from HCL Technologies. A security vulnerability exists in HCL BigFix Mobile/Modern Client Management, which arises from a brute-force cracking of passwords in the configuration interface...

CVE-2021-27782

CVE-2021-27782 affects HCL BigFix Mobile / Modern Client Management Admin and Config UI. The issue allows brute-forcing of passwords in the configuration interfaces, with recommended user lockout after multiple invalid attempts. Connected sources confirm this behavior but do not consistently spec...

CVE-2021-27782 HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack

HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts...

Trading Convenience for Credentials

Tap. Eat. Repeat. Regret? Using food or grocery delivery apps is great. It really is. Sure, there’s a fee, but when you can’t bring yourself to leave the house, it’s a nice treat to get what you want delivered. As a result, adoption of food apps has been incredibly fast and they are now a...

Dell EMC Storage信任管理问题漏洞

A security vulnerability exists in Dell EMC Storage, a data storage solution from Dell, U.S.A. The vulnerability stems from incorrect certificate revocation checks. An attacker could use the vulnerability to perform a man-in-the-middle attack and eavesdrop on encrypted communications from a cloud...

PT-2023-12120 · Hcl · Hcl Bigfix Mobile / Modern Client Management

Name of the Vulnerable Software and Affected Versions: HCL BigFix Mobile / Modern Client Management affected versions not specified Description: The issue allows passwords for the Admin and Config UI to be brute-forced. It is recommended that users should be locked out after multiple invalid...

CVE-2022-44032

A possible race condition was found in drivers/char/pcmcia/cm4000cs.c between the cmmopen and the cm4000detach functions if the user physically removes the PCMCIA device in the Linux kernel. This flaw may eventually result in a use-after-free UAF flaw. Mitigation This flaw can be mitigated by...

CVE-2023-21853

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Synchronization. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field...

CVE-2023-21853

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Synchronization. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field...

Design/Logic Flaw

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Synchronization. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field...

WordPress WPtouch Pro 3.3.4 Open Redirection

==================================================================================================================================== | Title : WordPress - WPtouch Pro: 3.3.4 Open Redirect Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle Mobile Fiel...

CVE-2023-21853

CVE-2023-21853 affects Oracle E-Business Suite, specifically the Oracle Mobile Field Service Synchronization component. The vulnerability impacts E-Business Suite versions 12.2.3–12.2.12 and can be exploited by an unauthenticated attacker with network access over HTTP to create, delete, or modify...

PT-2023-1240 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Synchronization component of Oracle Mobile Field Service. It allows an unauthenticated attacker with network...

XSS Vulnerability in Study Pass

Study Pass is a free app developed by Beijing Century Superstar Information Technology Development Limited Liability Company in 2016 that integrates mobile teaching, mobile learning, mobile reading and mobile socializing, and supports mobile only Android / iOS / Harmony OS. XSS vulnerability exis...

CVE-2022-4428

supporturi parameter in the WARP client local settings file mdm.xml lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a...

Design/Logic Flaw

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

CVE-2022-4457

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

CVE-2022-4457 WARP client manifest misconfiguration leading to Task Hijacking

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...