Design/Logic Flaw

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted syst...

CVE-2023-47610

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to execute arbitrary code on the targeted system by sending a specially crafted SMS message...

CVE-2023-47610

Summary of CVE-2023-47610 : A heap-based buffer overflow in the SMS handling path of Telit Cinterion modems (notably EHS5/6/8, with related references to BGS5 and PDS5/6/8 in PT-2023-9100) could allow a remote, unauthenticated attacker to execute arbitrary code on the target via a specially craft...

Telit Cinterion BGS5 Security Vulnerability

Telit Cinterion EHS5/6/8 is an edge device module from Telit Cinterion. A security vulnerability exists in the Telit Cinterion BGS5 that stems from the presence of a buffer copy vulnerability that does not check the input size, which could allow a remote, unauthenticated attacker to execute...

PT-2023-9100 · Telit · Telit Cinterion Ehs5/6/8 +1

Name of the Vulnerable Software and Affected Versions: Telit Cinterion EHS5/6/8 affected versions not specified Telit Cinterion BGS5 affected versions not specified Telit Cinterion PDS5/6/8 affected versions not specified Description: A Buffer Copy without Checking Size of Input vulnerability...

Google Android Information Disclosure Vulnerability (CNVD-2023-99039)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability, which is caused by the disclosure of side channel information in the SMS service. The vulnerability can be exploited by an attacker to obtain sensitive...

Phishers Spoof USPS, 12 Other Natl’ Postal Services

The fake USPS phishing page. Recent weeks have seen a sizable uptick in the number of phishing scams targeting U.S. Postal Service USPS customers. Heres a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS, as well as postal services i...

GoldDigger Android Trojan Targets Banking Apps in Asia Pacific Countries

A new Android banking trojan named GoldDigger has been found targeting several financial applications with an aim to siphon victims' funds and backdoor infected devices. "The malware targets more than 50 Vietnamese banking, e-wallet and crypto wallet applications," Group-IB said. "There are...

CVE-2023-41305

Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality...

Code injection

Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-41305

Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-41305

Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. Successful exploitation of this vulnerability may affect confidentiality...

CVE-2023-41305

CVE-2023-41305 describes a vulnerability where 5G messages could be sent without encryption within the Huawei HarmonyOS SMS message module, potentially exposing confidentiality. The underlying issue is weak/encryption gaps when transmitting 5G messages in a VPN environment. The NVD entry cites a ...

New Apple Zero-Days Exploited to Target Egyptian ex-MP with Predator Spyware

The three zero-day flaws addressed by Apple on September 21, 2023, were leveraged as part of an iPhone exploit chain in an attempt to deliver a spyware strain called Predator targeting former Egyptian member of parliament Ahmed Eltantawy between May and September 2023. "The targeting took place...

SMShell - Send Commands And Receive Responses Over SMS From Mobile Broadband Capable Computers

PoC for an SMS-based shell. Send commands and receive responses over SMS from mobile broadband capable computers. This tool came as an insipiration during a research on eSIM security implications led by Markus Vervier, presented at Offensivecon 2023 Disclaimer This is not a complete C2 but rather...

Retool Falls Victim to SMS-Based Phishing Attack Affecting 27 Cloud Clients

Software development company Retool has disclosed that the accounts of 27 of its cloud customers were compromised following a targeted and SMS-based social engineering attack. The San Francisco-based firm blamed a Google Account cloud synchronization feature recently introduced in April 2023 for...

CVE-2023-30719

Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certain message data...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung. A security vulnerability previously existed in SAMSUNG Mobile devices SMR Sep-2023 Release 1, which stemmed from the exposure of a sensitive information...

PT-2023-22920 · Unknown · Inboundsmshandler

Name of the Vulnerable Software and Affected Versions: InboundSmsHandler versions prior to SMR Sep-2023 Release 1 Description: The issue allows local attackers to access certain message data due to an Exposure of Sensitive Information vulnerability in InboundSmsHandler. This vulnerability enables...

WordPress Texty – SMS Notification for WordPress, WooCommerce, Dokan and more Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Texty – SMS Notification for WordPress, WooCommerce, Dokan and more Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim...