PT-2023-1240 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.12 Description: The issue is related to insufficient input validation in the Synchronization component of Oracle Mobile Field Service. It allows an unauthenticated attacker with network...

XSS Vulnerability in Study Pass

Study Pass is a free app developed by Beijing Century Superstar Information Technology Development Limited Liability Company in 2016 that integrates mobile teaching, mobile learning, mobile reading and mobile socializing, and supports mobile only Android / iOS / Harmony OS. XSS vulnerability exis...

CVE-2022-4428

supporturi parameter in the WARP client local settings file mdm.xml lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a...

Design/Logic Flaw

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

CVE-2022-4457

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

CVE-2022-4457 WARP client manifest misconfiguration leading to Task Hijacking

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

StrongPity Hackers Distribute Trojanized Telegram App to Target Android Users

The advanced persistent threat APT group known as StrongPity has targeted Android users with a trojanized version of the Telegram app through a fake website that impersonates a video chat service called Shagle. "A copycat website, mimicking the Shagle service, is used to distribute StrongPity's...

PT-2023-10331 · Salesforce · Salesforcemobilesdk-Windows

Name of the Vulnerable Software and Affected Versions: SalesforceMobileSDK-Windows versions up to 4.x Description: A critical issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/QuerySpec.cs, leading to sql injection. This issue only affects products that are no...

CVE-2022-39072

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks...

CVE-2022-39072

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks...

Sql injection

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks...

Ryde Technologies RYDE 信任管理问题漏洞

Ryde Technologies RYDE is a travel software from Ryde Technologies, USA. A security vulnerability exists in Ryde Technologies RYDE version 5.8.43 and earlier, which stems from an information disclosure due to insecure hostname authentication on Android and iOS, and can be exploited by an attacker...

CVE-2022-39072

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks...

CVE-2022-39072

CVE-2022-39072 concerns a SQL injection in Some ZTE Mobile Internet products stemming from insufficient validation of SNTP interface parameters. The issue is exploitable by an authenticated attacker and could lead to stored XSS in affected contexts. The documented CVSSv3.1 impact is Low confident...

CVE-2022-39072

There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks...

Exploit for Race Condition in Apple Safari

FileSwitcherX iOS 14.0-15.7.1 & 16.0-16.1.2 Install -...

HUAWEI EMUI/Magic UI 安全漏洞

Huawei EMUI is a mobile operating system developed based on Android.Huawei HarmonyOS is to provide a full-scenario distributed operating system based on microkernel. A security bypass vulnerability exists in Huawei EMUI and HarmonyOS.The vulnerability is caused due to dynamic hiding and restoring...

WordPress Mobile Pack Plugin for WordPress < 2.0.2 Sensitive Information Disclosure

The WordPress WordPress Mobile Pack Plugin installed on the remote host is affected by a Sensitive Information Disclosure. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

RedZei Chinese Scammers Targeting Chinese Students in the U.K.

Chinese international students in the U.K. have been targeted by persistent Chinese-speaking scammers for over a year as part of an activity dubbed RedZei aka RedThief. "The RedZei fraudsters have chosen their targets carefully, researched them and realized it was a rich victim group that is ripe...

@sweco/sweco-digital-platforms (>=5.0.26, <=5.1.2), @sweetui/sweet-mobile-sdk (>=1.6.3, <=1.6.7) +3 more potentially affected by CVE-2023-26133 via progressbar.js (>=1.0.1, <=1.1.0)

progressbar.js NPM version =1.0.1, =5.0.26, =1.6.3, =2.16.0, =1.0.33, =1.0.13, =1.0.14 Source cves: CVE-2023-26133 Source advisory: SNYK:JS-PROGRESSBARJS-3184152...