CVE-2016-3888

internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism, and send premium SMS messages during the...

Design/Logic Flaw

internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism, and send premium SMS messages during the...

CVE-2016-3883

internal/telephony/SMSDispatcher.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not properly construct warnings about premium SMS messages, which allows attackers to spoof the premium-payment confirmatio...

CVE-2016-3883

CVE-2016-3883 affects Android Telephony’s SMSDispatcher.java in the Telephony stack. The flaw is that premium-SMS warnings are not properly constructed, allowing a crafted app to spoof the premium-payment confirmation dialog. Affected Android versions include 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5...

CVE-2016-3883: Improper Access Control

internal/telephony/SMSDispatcher.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 does not properly construct warnings about premium SMS messages, which allows attackers to spoof the premium-payment confirmatio...

CVE-2016-3888: Undefined Security Weakness

internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism, and send premium SMS messages during the...

Navicat Premium 11.2.11 (64bit) Local Database Password Disclosure Vulnerability

Navicat premium is a database management tool. Navicat Premium client v11.2.11 suffers from a local password disclosure vulnerability, where the password is stored in plaintext and can be exploited to obtain the database password...

Navicat Premium 11.2.11 (x64) - Local Database Password Disclosure

Exploit for windows platform in category local exploits Navicat Premium 11.2.11 64bit Local Password Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.navicat.com/ Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman...

Navicat Premium 11.2.11 (x64) - Local Database Password Disclosure

Navicat Premium 11.2.11 x64 - Local Database Password Disclosure Navicat Premium 11.2.11 64bit Local Password Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.navicat.com/ Date 05/09/2016 Bug Discovered by Yakir Wizman...

Navicat Premium 11.2.11 (64bit) Local Password Disclosure

Navicat Premium 11.2.11 64bit Local Password Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.navicat.com/ Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman http://www.black-rose.ml Special Thanks & Greetings to...

Navicat Premium 11.2.11 (x64) - Local Database Password Disclosure

Navicat Premium 11.2.11 64bit Local Password Disclosure Tested on Windows Windows Server 2012 R2 64bit, English Vendor Homepage @ https://www.navicat.com/ Date 05/09/2016 Bug Discovered by Yakir Wizman https://www.linkedin.com/in/yakirwizman http://www.black-rose.ml Special Thanks & Greetings to...

That's A Clever Hack! How anyone could make Money from Google and Microsoft

Smart hackers could exploit a loophole that could allow them to steal a significant amount of cash from Google, Microsoft and Instagram using a Premium rate phone number. Security researcher Arne Swinnen from Belgium has discovered an ingenious way to steal money from big tech companies like...

WordPress Plugin Ultimate Product Catalog 3.8.6 - Arbitrary File Upload

Exploit Title: Wordpress Ultimate-Product-Catalog v3.8.6 Arbitrary file RCE Date: 2016-06-23 Google Dork: Index of /wp-content/plugins/ultimate-product-catalogue/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Vendor Homepage: http://www.EtoileWebDesign.com/ plugin uri:...

Wordpress Premium SEO Pack 1.9.1.3 Plugin - wp_options Overwrite

Exploit for php platform in category web applications Vendor Homepage: http://aa-team.com/ Software Link: http://codecanyon.net/item/premium-seo-pack-wordpress-plugin/6109437?srank=2 Version: 1.9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated customer, subscriber wpoptions overwrite Ti...

WordPress Premium SEO Pack 1.9.1.3 wp_options Overwrite

Vendor Homepage: http://aa-team.com/ Software Link: http://codecanyon.net/item/premium-seo-pack-wordpress-plugin/6109437?srank=2 Version: 1.9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated customer, subscriber wpoptions overwrite Time line: Found 05-Jun-2016, Vendor notified 05-Jun-201...

WordPress Plugin Premium SEO Pack 1.9.1.3 - wp_options Overwrite

WordPress Plugin Premium SEO Pack 1.9.1.3 - wpoptions Overwrite Vendor Homepage: http://aa-team.com/ Software Link: http://codecanyon.net/item/premium-seo-pack-wordpress-plugin/6109437?srank=2 Version: 1.9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated customer, subscriber wpoptions...

WordPress Plugin Premium SEO Pack 1.9.1.3 - wp_options Overwrite

Vendor Homepage: http://aa-team.com/ Software Link: http://codecanyon.net/item/premium-seo-pack-wordpress-plugin/6109437?srank=2 Version: 1.9.1.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Authenticated customer, subscriber wpoptions overwrite Time line: Found 05-Jun-2016, Vendor notified 05-Jun-201...

Xero: Insecure Payment System Integration

A flaw in our Credit Card Verification process was reported that could have allowed an attacker to avail themselves of a Xero Subscription without paying for it, for a month at most. This was rated as non-critical and was quickly fixed. Mitigation measures were in place to detect any abuse and we...

LOCKON EC-CUBE Social-button Premium Plugin Cross-Site Scripting Vulnerability

LOCKON EC-CUBE is an open source e-commerce website building platform developed by Japan LOCKON Co. A cross-site scripting vulnerability exists in version 1.0 of the Social-button Premium plugin for LOCKON EC-CUBE 2.13.x. The vulnerability can be exploited to inject arbitrary Web script or HTML. ...

CVE-2016-1180

Cross-site scripting XSS vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...