Information disclosure

Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...

CVE-2017-5238

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

CVE-2017-5239

CVE-2017-5239 concerns the Eview EV-07S GPS Tracker, where information disclosure occurs due to a lack of standard encryption when transmitting sensitive data (e.g., GPS data, IMEI) to a centralized monitoring service. The vulnerability implies potential MITM exposure of PII over the network. The...

CVE-2017-5238

Due to a lack of bounds checking, several input configuration fields for the Eview EV-07S GPS Tracker will overflow data stored in one variable to another, overwriting the data of another field...

CVE-2017-5237

CVE-2017-5237 affects the Eview EV-07S GPS Tracker. The issue stems from a lack of authentication, allowing an unauthenticated user who knows the device’s phone number to revert it to factory default via an SMS command (“RESET!”). This corresponds to a high impact on availability (CVSSv3: 7.5) wi...

CVE-2017-5237

Due to a lack of authentication, an unauthenticated user who knows the Eview EV-07S GPS Tracker's phone number can revert the device to a factory default configuration with an SMS command, "RESET!"...

CVE-2017-5239

Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...

CVE-2017-5238

The CVE-2017-5238 entry concerns the Eview EV-07S GPS Tracker, where a buffer/overflow happens due to insufficient boundary checks in several input configuration fields. The CNVD entry confirms the root cause as a lack of bounds checking that allows overflowing data from one variable into another...

Microsoft Windows - Uniscribe Font Processing Multiple Heap Out-of-Bounds and Wild Reads (MS17-011)

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1031 Through fuzzing, we have discovered a number of different crashes in the Windows Uniscribe user-mode library, while trying to display text using a corrupted font file or calling documented Uniscribe API functions against such...

Mozilla Firefox - table Use-After-Free

Mozilla Firefox - table Use-After-Free body display: table function freememory try fuzzPriv.forceGC; catcherr alert'Please install domFuzzLite3'; function go var s = document.getSelection; window.find"1",true,false,true,false; s.modify"extend","forward","line";...

AfterShip Package Tracker - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application AfterShip Package Tracker published at the 'play' market has multiple vulnerabilities...

CVE-2014-9905

Multiple cross-site scripting XSS vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 title of an appointment or 2 contact fields...

Ovia Fertility Tracker - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Ovia Fertility Tracker published at the 'play' market has multiple vulnerabilities...

CVE-2016-7164

The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service segmentation fault and crash via a crafted GZIP response...

CVE-2016-7164

The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service segmentation fault and crash via a crafted GZIP response...

Cross-Site Scripting (XSS)

rack-tracker is vulnerable to cross-site scripting XSS attack. The library is vulnerable to cross-site scripting because the library does not santise escape characters...

A-Tracker - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application A-Tracker published at the 'play' market has multiple vulnerabilities...

Information Disclosure

products.poi is vulnerable to information disclosure. In workflows, the issues tracker inside private folder is visible to anonymous users...

Fedora 24 : tracker (2016-631737a49a)

This update adds security sandboxing to tracker-extract. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

MGASA-2016-0432 Updated tracker packages fix security vulnerability

It was discovered that Tracker incorrectly handled certain malformed GIF images. If a user or automated system were tricked into downloading a specially-crafted GIF image, Tracker could crash, resulting in a denial of service...