CVE-2017-14269

EE 4GEE WiFi MBB before EE600005.0031 devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content...

CVE-2017-14269

CVE-2017-14269 affects EE 4GEE WiFi MBB devices (before EE60_00_05.00_31). The vulnerability allows remote attackers to obtain sensitive data via a JSONP endpoint, demonstrated as passwords and SMS content exposure. The root cause is an insecure JSONP/endpoint handling that leaks confidential inf...

CVE-2017-14269

EE 4GEE WiFi MBB before EE600005.0031 devices allow remote attackers to obtain sensitive information via a JSONP endpoint, as demonstrated by passwords and SMS content...

WordPress Contact Form 7 International SMS Integration 1.2 XSS Vulnerability

WordPress Contact Form 7 International SMS Integration plugin version 1.2 suffers from a cross site scripting vulnerability. | Exploit Title: Wordpress Contact Form 7 International Sms Integration Plugin Cross Site Scripting | Exploit Author: Ashiyane Digital security Team | Vendor Homepage :...

Textra SMS - Dangerous filesystem permissions, Hardcoded secrets, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Textra SMS published at the 'play' market has multiple vulnerabilities...

Unikrn: Improper validation at Phone verification (possible cost increase + SMS SPAM attack)

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Please add the affected...

WAP-billing Trojan-Clickers on rise

During the preparation of the "IT threat evolution Q2 2017" report I found several common Trojans in the "Top 20 mobile malware programs" list that were stealing money from users using WAP-billing - a form of mobile payment that charges costs directly to the user's mobile phone bill so they don't...

Logic Design Vulnerability in Tlink IoT Cloud Service Platform Android App

TLINK Internet of Things is an open platform for Internet of Things products of Shenzhen Analog Technology Co. A logical design vulnerability exists in the Android App password recovery function of Tlink IoT cloud service platform. It allows the attacker to send unlimited SMS to the modified cell...

Android Trojan Now Targets Non-Banking Apps that Require Card Payments

The infamous mobile banking trojan that recently added ransomware features to steal sensitive data and lock user files at the same time has now been modified to steal credentials from Uber and other booking apps as well. Security researchers at Kaspersky Lab have discovered a new variant of the...

Booking a Taxi for Faketoken

The Trojan-Banker.AndroidOS.Faketoken malware has been known about for already more than a year. Throughout the time of its existence, it has worked its way up from a primitive Trojan intercepting mTAN codes to an encrypter. The authors of its newer modifications continue to upgrade the malware,...

Shandong government service app for Android has SMS bombing vulnerability

Shandong government service APP is a government information software created by the Shandong Government Office. The software can release the latest information of Shandong government services in time, support personalized subscription, full-text search function, to provide faster service for the...

Apple iOS 10.3 - UI SMS Access Permission Vulnerability

Document Title: =============== Apple iOS 10.3 - UI SMS Access Permission Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2078 Apple Security ID: 666589482 Video: https://www.vulnerability-lab.com/getcontent.php?id=2079 Vulnerability...

Apple iOS v10.3 - UI SMS Access Permission Vulnerability

Document Title: =============== Apple iOS v10.3 - UI SMS Access Permission Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2079 Video: https://www.youtube.com/watch?v=jePRogkoon8 Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2078...

Apple iOS 10.3 - UI SMS Access Permission Vulnerability

Document Title: =============== Apple iOS 10.3 - UI SMS Access Permission Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2078 Apple Security ID: 666589482 Video: https://www.vulnerability-lab.com/getcontent.php?id=2079 Vulnerability...

Apple iOS v10.3 - UI SMS Access Permission Vulnerability

Document Title: =============== Apple iOS v10.3 - UI SMS Access Permission Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2079 Video: https://www.youtube.com/watch?v=jePRogkoon8 Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2078...

Mobile Menace Monday: Malicious clicker with extra maliciousness included

A new malicious clicker has emerged onto third-party app stores. Chinese in origin, the malicious app uses heavy obfuscation and poses as a battery optimizer app. We classify is as Android/Trojan.Clicker.hyj. Click to view slideshow. Hide what’s inside To obfuscate its code, Clicker.hyj uses an A...

Mood Messenger - SMS & MMS - Base64 encoded String, Exported ContentProvider, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Mood Messenger - SMS & MMS published at the 'play' market has multiple vulnerabilities...

Cuvva: CSRF on cuvva.insure allows to attacker to send multiple SMS to download the app without visiting the cuvva

Description : cuvva.co allows user to send app download link to his/her mobile number via SMS. But attacker can abuse this system via cross site request forgery and can send SMS to N number of mobile numbers without even visiting the cuvva.com/cuvva.insure website. Reproduction Steps :...

How CIA Agents Covertly Steal Data From Hacked Smartphones (Without Internet)

WikiLeaks has today published the 16th batch of its ongoing Vault 7 leak, this time instead of revealing new malware or hacking tool, the whistleblower organisation has unveiled how CIA operatives stealthy collect and forward stolen data from compromised smartphones. Previously we have reported...

CVE-2015-3840

The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS messages without the associated "WRITESMS" permission...