CVE-2019-7278

Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...

CVE-2019-7278

Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...

Design/Logic Flaw

Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...

CVE-2019-7278

Optergy Proton/Enterprise devices have an Unauthenticated SMS Sending Service...

CVE-2019-7278

CVE-2019-7278 affects Optergy Proton/Enterprise Building Management System. Root cause: Exposed Dangerous Method or Function (CWE-749) allowing unauthenticated access to a sensitive function. Impact: cryptic in public docs, but CVSSv3 base score is 7.3 (medium-high) with network access, no user i...

ViceLeaker Operation: mobile espionage targeting Middle East

In May 2018, we discovered a campaign targeting dozens of mobile Android devices belonging to Israeli citizens. Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims; and a hash of the APK involved Android application was tagged in our sample feed for...

Riltok mobile Trojan: A banker with global reach

Riltok is one of numerous families of mobile banking Trojans with standard for such malware functions and distribution methods. Originally intended to target the Russian audience, the banker was later adapted, with minimal modifications, for the European "market." The bulk of its victims more tha...

MobOk Malware Hides in Photo Editors on Google Play, Siphons Cash

A powerful money-siphoning malware known as MobOk has been found hiding in seemingly legitimate photo editing apps available on the Google Play store. The Pink Camera and Pink Camera 2 apps, now removed, had been installed around 10,000 times, according to researchers at Kaspersky. They included...

CVE-2018-17387

CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account...

CVE-2018-17387

CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account...

Cross site request forgery (csrf)

CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account...

CVE-2018-17387

CVE-2018-17387 affects Nimble Messaging Bulk SMS Marketing Application 1.0. The issue is a Cross-Site Request Forgery (CSRF) that enables adding an admin account. CVSS3 base score 8.8 (HIGH) with NETWORK attack vector, UI required, and HIGH impact on confidentiality, integrity, and availability. ...

CVE-2018-17387

CSRF exists in Nimble Messaging Bulk SMS Marketing Application 1.0 for adding an admin account...

Unikrn: Rate Limit workaround in the message of the phone number verification

There was a to more or less trivial workaround to the SMS resend rate limit. Thx @drakm !...

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free Exploit

Visual Voicemail VVM is a feature of mobile devices that allows voicemail to be read in an email-like format. Carriers set up a Visual Voicemail server that supports IMAP, and the device queries this server for new email. Visual Voicemail is configured over SMS, and carriers inform devices of the...

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free

Visual Voicemail VVM is a feature of mobile devices that allows voicemail to be read in an email-like format. Carriers set up a Visual Voicemail server that supports IMAP, and the device queries this server for new email. Visual Voicemail is configured over SMS, and carriers inform devices of the...

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free

Visual Voicemail for iPhone - IMAP NAMESPACE Processing Use-After-Free Visual Voicemail VVM is a feature of mobile devices that allows voicemail to be read in an email-like format. Carriers set up a Visual Voicemail server that supports IMAP, and the device queries this server for new email. Visu...

Telenor.com.pk SMS 2-Factor Bypass

Title: Telenor.com.pk Connect Account SMS PIN Redirection Author: Muhammad Shahbaz LinkedIn: https://www.linkedin.com/in/mr-muhammad-shahbaz/ Found: 2019-04-01 Attack Pattern: Telenor.com.pk Connect Account has a fundamental design flaw where the client can send a random telenor phone number...

Google Android Framework SmsDefaultDialog.java file elevation of privilege vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. An elevation of privilege vulnerability exists in the SmsDefaultDialog.onStart file in Android. An attacker can exploit this vulnerability to bypass user interaction requests and gain additional...

Trend Micro TippingPoint Security Management System (SMS) Detection (HTTP)

The script sends a HTTP request to the remote host and attempts to detect the presence of a Trend Micro TippingPoint Security Management System SMS. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...