20646 matches found
CVE-2021-47803 iFunbox 4.2 - 'Apple Mobile Device Service' Unquoted Service Path
iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privileges. Attackers can insert a malicious executable into the unquoted service path to run with LocalSystem privileges when the service...
CVE-2021-47803
CVE-2021-47803 concerns iFunbox 4.2, where an unquoted service path in the Apple Mobile Device Service enables local attackers to execute code with elevated privileges. The root cause is an unquoted service path allowing a malicious executable to be started when the service restarts, leading to L...
CVE-2025-14317
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...
CVE-2026-0739
The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level...
PT-2026-3173
iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privileges. Attackers can insert a malicious executable into the unquoted service path to run with LocalSystem privileges when the service...
Verizon Outage Knocks Out US Mobile Service, Including Some 911 Calls
A major Verizon outage appeared to impact customers across the United States starting around noon ET on Wednesday. Calls to Verizon customers from other carriers may also be impacted...
CVE-2025-14317
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...
CVE-2025-14317
CVE-2025-14317 – Crazy Bubble Tea mobile app : An authenticated attacker can obtain personal information of other users by enumerating a loyaltyGuestId parameter. The server does not verify required permissions to access data. This has been fixed in Android version 915 and iOS version 7.4.1. Affe...
CVE-2025-14317 User Enumeration in Crazy Bubble Tea mobile application
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...
CVE-2026-0739
The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level...
CVE-2026-0739 WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
The WMF Mobile Redirector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level...
CVE-2026-0739
The CVE CVE-2026-0739 affects WMF Mobile Redirector for WordPress (authors: Wordfence/patch sources) and is a Stored Cross-Site Scripting vulnerability in plugin settings. Affected versions: up to 1.2. Root cause per the sources: insufficient input sanitization and output escaping within plugin s...
WordPress plugin WMF Mobile Redirector 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based...
WordPress WMF Mobile Redirector plugin <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting via Settings Parameters vulnerability discovered by 0x34rth in WordPress Plugin WMF Mobile Redirector versions = 1.2...
Schneider Electric EcoStruxure Power Build Rapsody (Update A)
GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install physical controls so no unauthorized personnel can access...
VIAVIWEB Wallpaper Admin 代码问题漏洞
VIAVIWEB Wallpaper Admin is a mobile application backend management system from VIAVIWEB India. A code issue vulnerability exists in VIAVIWEB Wallpaper Admin version 1.0, which stems from an unauthenticated remote code execution vulnerability in the image upload functionality that could lead to t...
Celebrating reviews and recognitions for Malwarebytes in 2025
Independent recognition matters in cybersecurity, and it matters a lot to us. It shows how security products perform when they’re tested against in-the-wild threats, using lab environments designed to reflect what people actually face in the real world. In 2025, Malwarebytes earned awards and...
ALFA: A Safe-By-Design Approach to Mitigate Quishing Attacks Launched Via Fancy QR Codes
Phishing with Quick Response QR codes is termed as Quishing. The attackers exploit this method to manipulate individuals into revealing their confidential data. Recently, we see the colorful and fancy representations of QR codes, the 2D matrix of QR codes which does not reflect a typical mixture ...
CVE-2023-29656
An improper authorization vulnerability in Darktrace mobile app Android prior to version 6.0.15 allows disabled and low-privilege users to control "antigena" actionsblock/unblock traffic from the mobile application. This vulnerability could create a "shutdown", blocking all ingress or egress...