toy-people.com Cross Site Scripting vulnerability

Security Researcher IAMMUSTAFA Helped patch 521 vulnerabilities Received 9 Coordinated Disclosure badges Received 51 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting toy-people.com website and its users. Following...

Crunchbase Cognitoys Dino Cross-Site Request Forgery Vulnerability

Crunchbase Cognitoys Dino is a children's cognitive electronic learning toy from Crunchbase USA. A cross-site request forgery vulnerability exists in the Crunchbase Cognitoys Dino device. The vulnerability stems from the WEB application not adequately verifying that a request is from a trusted...

japan-toy-museum.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-926218 Security Researcher geeknik Helped patch 8938 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting japan-toy-museum.org websit...

Hacking an assault tank… A Nerf one

TL;DR A complex, challenging reverse and hijack of a toy tank Nerf gun camera, but the result was we got to shoot the 44Con conference organiser with it! Why A remote-controlled Nerf gun with video feed and aiming crosshairs. Who wouldn’t want to reverse the RF and firmware, with a view to...

Whole Vibratissimo Smart Sex Toy XSS / Disclosure / Authentication

We have published an accompanying blog post to this technical advisory with further information: https://www.sec-consult.com/en/blog/2018/02/internet-of-dildos-a-long-way-to-a-vibrant-future-from-iot-to-iod/index.html SEC Consult Vulnerability Lab Security Advisory...

CVE-2017-8867

Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 use AES-128 with ECB mode to encrypt voice traffic between the device and remote server, allowing a malicious user to map encrypted traffic to a particular AES key index and gaining further access to eavesdrop on...

CVE-2017-8866

Elemental Path's CogniToys Dino smart toys through firmware version 0.0.794 share a fixed small pool of hardcoded keys, allowing a remote attacker to use a different Dino device to decrypt VoIP traffic between a child's Dino and remote server...

A week in security (December 04 – December 10)

Last week on the blog, we looked at a RIG EK malware campaign, explored how children are being tangled up in money mule antics, took a walk through the world of Blockchain, and gave a rundown of what's involved when securing web applications. We also laid out the trials and tribulations of the...

toy-people.com XSS vulnerability

Vulnerable URL: https://www.toy-people.com/?s=aaaaa%22%3E%3Csvg/onload=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.10.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 12036 VIP website status:| Yes...

Children's Voice Messages Leaked in CloudPets Database Breach

More than two million voice messages, many of them from children, along with the personal information of more than 800,000 registered users was swiped from an exposed MongoDB instance storing data collected from a internet-connected toy called CloudPets. These IP-enabled teddy bears allow childre...

Internet-Connected Teddy Bear Leaks Millions Of Voice Messages and Password

Every parent should think twice before handing out Internet-connected toys or smart toys to their children, as these creepy toys pose a different sort of danger: privacy and data security risks for kids who play with them. This same incident was happened over a year ago when Hong Kong toymaker...

Toy Guitar with songs for kids - Native code usage, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Toy Guitar with songs for kids published at the 'play' market has multiple vulnerabilities...

Puzzle Toy for kids - Native code usage, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Puzzle Toy for kids published at the 'play' market has multiple vulnerabilities...

Kids Toy Phone Learning Games - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Kids Toy Phone Learning Games published at the 'play' market has multiple vulnerabilities...

Baby Rattle Toy - Child Lock - BSD license, Customized SSL, GPL license vulnerabilities

HackApp vulnerability scanner discovered that application Baby Rattle Toy - Child Lock published at the 'play' market has multiple vulnerabilities...

Christmas Games: Toy Party - Base64 encoded String, Customized SSL, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Christmas Games: Toy Party published at the 'play' market has multiple vulnerabilities...

Toy Train Puzzles for Toddlers - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Toy Train Puzzles for Toddlers published at the 'play' market has multiple vulnerabilities...

Baby Toy with Lock - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Baby Toy with Lock published at the 'play' market has multiple vulnerabilities...

Toy Warfare - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Toy Warfare published at the 'play' market has multiple vulnerabilities...

Toy Train Tycoon - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Toy Train Tycoon published at the 'play' market has multiple vulnerabilities...