Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing

Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the mobile network. One way to provision a device is via a WAP push SMS message containing provisioning...

Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing

OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the mobile network. One way to provision a device is via a WAP push SMS message containing provisioning information in WbXML. A malformed OMACP WAP push message can cause memory...

Samsung Patches Six Critical Bugs in Flagship Handsets

Samsung began rolling out patches over the weekend to fix six critical bugs found in its flagship Android handsets as part of its May patch bulletin. Flaws range from a remote code execution bug to a buffer overflow vulnerability, plus a peek-and-poke command bug that leaves memory locations open...

Romanian Hackers Extradited to U.S. over $18M Vishing Scam

A pair of Romanian hackers have been extradited to the U.S. after allegedly bilking unwitting victims out of more than $18 million in an elaborate voice- and SMS-phishing i.e., vishing/smishing scheme. Teodor Laurentiu Costea and Robert Codrut Dumitrescu were named in the 31-count federal grand...

Multiple Vulnerabilities in Android App for US LinkSys Routers

Linksys Smart Wi-Fi Routers are smart Wi-Fi routers. An arbitrary user registration, information disclosure, and SMS bombing vulnerability exists in the US LinkSys Routers Android APP. Attackers use the vulnerability to register any email address and can send unlimited reset password emails,...

CVE-2018-10108

D-Link DIR-815 REV. B with firmware through DIR-815REVBFIRMWAREPATCH2.07.B01 devices have XSS in the Treturn parameter to /htdocs/webinc/js/bscsmsinbox.php...

PT-2018-9684 · D Link · D-Link Dir-815

Name of the Vulnerable Software and Affected Versions: D-Link DIR-815 REV. B versions through DIR-815 REVB FIRMWARE PATCH 2.07.B01 Description: The issue concerns a problem with the Treturn parameter in the /htdocs/webinc/js/bsc sms inbox.php API endpoint, which can be exploited. Recommendations:...

D-Link DIR-815 Cross-Site Scripting Vulnerability

D-Link DIR-815 REV.B is a wireless router product from AUO D-Link. A cross-site scripting vulnerability exists in the D-Link DIR-815 REV. B using firmware DIR-815REVBFIRMWAREPATCH2.07.B01 and prior versions. A remote attacker can exploit this vulnerability by sending the 'Treturn' parameter to th...

Mercury - A Hacking Tool Used To Collect Information And Use The Information To Further Hurt The Target

Mercury is a hacking tool used to collect information and use the information to further hurt the target. Installation Requires Python2 Linux apt-get install python2 git clone https://www.github.com/MetaChar/Mercury pip install -r requirements.txt Features BruteForce Mercury uses Selenium to...

BOHEMIA INTERACTIVE a.s.: (Possible) staff account takeover via reset token bruteforce at helpdesk.bistudio.com

As stated in a brief exchange with @rvn in my other report 312433, I might have found a logic flaw in the way https://helpdesk.bistudio.com handles the reset flow and tokens. I've asked if it was possible to obtain a test account, but I fully understand that it's something that cannot be done; as...

CVE-2018-4140

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Telephony" component. It allows remote attackers to cause a denial of service NULL pointer dereference and reboot via a Class 0 SMS message...

Null pointer dereference

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Telephony" component. It allows remote attackers to cause a denial of service NULL pointer dereference and reboot via a Class 0 SMS message...

CVE-2018-4140

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Telephony" component. It allows remote attackers to cause a denial of service NULL pointer dereference and reboot via a Class 0 SMS message...

sms-services.nl XSS vulnerability

Open Bug Bounty ID: OBB-595503 Description| Value ---|--- Affected Website:| sms-services.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

You down with P2P? 10 tips to secure your mobile payment app

If you look at the figures, you cannot deny that the eCommerce industry is steadily growing. More and more people are doing their shopping online, not only for products and services geared toward the use of technologies and the Internet, but also for items previously only found in brick and morta...

Youxin Used Car App Has Logic Design Flaws

Youxin Used Car APP is a cell phone used car information buying service software. There is a logical design vulnerability in Ushin Used Car APP. Attackers can bombard the client with SMS messages by replaying packets that send CAPTCHA without restriction...

Facebook collected users’ call and SMS logs with “their permission”

By Waqas Facebook is in hot waters for the last couple of This is a post from HackRead.com Read the original post: Facebook collected users' call and SMS logs with "their permission"...

Facebook Collected Your Android Call History and SMS Data For Years

Facebook knows a lot about you, your likes and dislikes—it's no surprise. But do you know, if you have installed Facebook Messenger app on your Android device, there are chances that the company had been collecting your contacts, SMS, and call history data at least until late last year. A tweet...

Mail.ru: Full account takeover am.ru

m.am.ru had no sufficient protection against bruteforce for SMS OTP. am.ru is not currently covered by Bug Bounty program...

Название Бота Stepa

Возможности Бота + Админ панель Защита от DDos; + Отправка, перехват и удаление СМС-сообщений; + Отображение ботов по категория; + Есть удобная система событий для каждого бота; + Удобный вывод СМС сообщений в диалоге; + Автокрипт apk через api + Отдельная услуга; + Смена и подмена...