CVE-2020-14021

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

CVE-2020-14021

The CVE-2020-14021 entry concerns Ozeki NG SMS Gateway (up to version 4.17.6). The ASP.NET SMS module can be coerced via path manipulation to read arbitrary files on the operating system, typically with NT AUTHORITY\SYSTEM privileges. This is a file-read vulnerability stemming from the module han...

CVE-2020-14029

CVE-2020-14029 affects Ozeki NG SMS Gateway up to version 4.17.6. The RSS To SMS module processes XML files in an unsafe manner, enabling an XML External Entity (XXE) attack that can be used to perform SSRF or read arbitrary local files. The available documents provide CVSS2/3.1 metrics (MEDIUM/H...

CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

TikTok: Bypass SMS verification to delete TikTok account

Improper authorization could potentially allow an attacker to bypass SMS verification and delete a TikTok account. This attack would first require the account to be compromised. A fix has been implemented to resolve this issue. We thank @luizviana for reporting this to our team and confirming the...

CVE-2019-11859

A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...

Buffer overflow

A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...

CVE-2019-11859

CVE-2019-11859 affects ALEOS and its SMS Handler API. A buffer overflow in the SMS handler prior to versions 4.13.0, 4.9.5, and 4.9.4 may allow code execution as root. Connected sources corroborate the vulnerability in the SMS handling path and list vulnerable version ranges, with patch/stabiliza...

CVE-2019-11859 ALEOS SMS Handler Buffer Overflow

A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...

Flaws in Samsung Phones Exposed Android Users to Remote Attacks

New research disclosed a string of severe security vulnerabilities in the 'Find My Mobile'—an Android app that comes pre-installed on most Samsung smartphones—that could have allowed remote attackers to track victims' real-time location, monitor phone calls, and messages, and even delete data...

PT-2020-20366 · Google · Google Play Core Library

Name of the Vulnerable Software and Affected Versions: Google Play Core Library versions prior to 1.7.2 Description: A local, arbitrary code execution issue exists in the SplitCompat.install endpoint in Android's Play Core Library. This allows a malicious attacker to create an apk that targets a...

Mail.ru: Forgot Password Page SMS Brute Force could lead to Account Takeover using Android/IOS app "About the house" via api.prodom.smart.space

Password recovery procedure was not sufficiently protected against bruteforce and allowed arbitrary smart.space account takeover...

Mail.ru: SMS Brute Force Possibility via https://youdrive.today/login/web/code can lead to Account Takeover

Authentication procedure was not sufficiently protected against bruteforce and allowed arbitrary youdrive.today account takeover...

Mail.ru: [combo.mail.ru] SMS code bruteforce

Authentication procedure was not sufficiently protected against bruteforce and allowed arbitrary combo.mail.ru account takeover...

FakeSpy Android Malware Spread Via ‘Postal-Service’ Apps

Android mobile device users are being targeted in a new SMS phishing campaign that’s spreading the FakeSpy infostealer. The malware, which is disguised as legitimate global postal-service apps, steals SMS messages, financial data and more from the victims’ devices. The campaign was first discover...

How to Switch to Signal and Bring All your Texts With You

Thinking of boosting your SMS security by switching to Signal? These tips make sure your messages come with you—even to a new phone...

Mail.ru: Брутфорс sms кода подтверждения для смены номера телефона в аккаунте LootDog.

SMS code for phone number change in lootdog.io was not sufficiently protected against bruteforce...

Making the Most of SPS Secure Consumer: Go To Market Best Practices

Seeing opportunities as residential internet services have been transformed into business internet services, ISPs and Mobile Network Operators MNOs are making moves to use the power of their networks to protect customers. As they progress through the decision and deployment cycles, we often get...

StrandHogg 2.0 Critical Bug Allows Android App Hijacking

A critical privilege-escalation vulnerability affecting Android devices has been found that allows attackers to hijack any app on an infected phone – potentially exposing private SMS messages and photos, login credentials, GPS movements, phone conversations and more. The bug is dubbed the...

New Android Flaw Affecting Over 1 Billion Phones Let Attackers Hijack Apps

Remember Strandhogg? A security vulnerability affecting Android that malicious apps can exploit to masquerade as any other app installed on a targeted device to display fake interfaces to the users, tricking them into giving away sensitive information. Late last year, at the time of its public...