Google Android System Elevation of Privilege Vulnerability

Android is a set of Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. systemnfc is one of the NFC components. An elevation of privilege vulnerability exists in systemnfc in Android. An attacker can use this vulnerability to bypass security...

Cicada Knowledge Enterprise Portal open source version 6.5 suffers from cross-site scripting vulnerabilities

Cicada Knowledge Enterprise Portal System is an enterprise portal system designed for enterprise marketing use. Cicada Knowledge Enterprise Portal Open Source Edition 6.5 suffers from a cross-site scripting vulnerability, which can be exploited by attackers to insert malicious js code and obtain...

user/license_save.php arbitrary file deletion

No description provided by source...

Directory Traversal Vulnerability in Hiroshima Carsharing App Android Version

Hiroshima Car Sharing App is a car rental software. There is a directory traversal vulnerability in the Android version of Hongyang Shared Car APP, which can be exploited by an attacker to directly view and download sensitive information such as ID card, driver's license, db file, code...

CVE-2016-2974

IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime environment as well as other users on the local machine of the user. IBM X-Force ID: 113934...

Anonymous Messaging App Sarahah to Halt Collection of User Data With Next Update

Sarahah, the anonymous messaging app that shot to the top of app stores earlier this summer, says it plans to remove a feature that uploads users’ contacts, including phone numbers and email addresses to the company’s servers, in the next update. The app’s creator, Zain al-Abidin Tawfiq, caught...

Shenzhen Yuanzheng Technology golo android app has information leakage vulnerability

golo APP is a social networking application that uses instant messaging as a communication platform to connect automotive repair technicians with car owners. Shenzhen Yuanzheng Technology golo Android APP has information leakage vulnerability. The attacker can view the user's sensitive informatio...

Shenzhen Yuanzheng Technology golo Android APP has overstepped access vulnerability

golo APP is a social networking application that uses instant messaging as a communication platform to connect automotive repair technicians with car owners. Shenzhen Yuanzheng Technology's golo Android APP has an overstepping access vulnerability, which allows an attacker to view any registered...

Shadow Collar Android app has information leakage vulnerability

Shadow Collar app is a mobile social forum client for imaging doctors. There is an information leakage vulnerability in Shadow Collar Android app. An attacker can use the vulnerability to reset any user's password, obtain user's name, cell phone number, email address and other information...

libgig Denial of Service Vulnerability

libgig is a C++ library for loading, modifying and creating Gigasamlier and DLS files. A denial of service vulnerability exists in the 'gig::DimensionRegion::CreateVelocityTable' function of the gig.cpp file in libgig version 4.0.0. A remote attacker can exploit this vulnerability to cause a deni...

Over 500 Android Apps On Google Play Store Found Spying On 100 Million Users

Over 500 different Android apps that have been downloaded more than 100 million times from the official Google Play Store found to be infected with a malicious ad library that secretly distributes spyware to users and can perform dangerous operations. Since 90 per cent of Android apps is free to...

Android Spyware Linked to Chinese SDK Forces Google to Boot 500 Apps

More than 500 Android mobile apps have been removed from Google Play after it was discovered that an embedded advertising SDK could be leveraged to quietly install spyware on devices. The SDK, called Igexin, was developed by a Chinese company and may have been used to install malware that could,...

Jiaxing Public Security App Has Arbitrary Account Login Vulnerability

Jiaxing Public Security APP is a convenient mobile application for local people in Jiaxing to find local services, mainly including motor vehicle violation inquiry, immigration office appointment, police news, security, police map, law enforcement public and other functional services. Jiaxing...

Joomla Core SetType Cross-Site Scripting (CVE-2017-9934)

A Cross-Site Scripting vulnerability exists in Joomla Core. The vulnerability is due to improper validation of user data. A remote attacker can exploit this vulnerability by sending a crafted request to the target...

It's Not Exactly Open Season on the iOS Secure Enclave

The black box that is Apple’s iOS Secure Enclave may have been pried open, but that doesn’t necessarily mean it’s open season on iPhones and iPads worldwide. Yesterday’s public disclosure of the decryption key for the Secure Enclave Processor firmware does indeed allow white and black hats to pok...

Legal Robot: Privilege Escalation to Admin-level Account

A security researcher discovered a potentially serious privilege escalation issue in our system which was ultimately traced to our use of the allow-deny package provided in the open source Meteor framework. We implemented a short-term fix using triggers - not great performance on the same day thi...

Hacker Publishes iOS Secure Enclave Firmware Decryption Key

A hacker Thursday afternoon published what he says is the decryption key for Apple iOS’ Secure Enclave Processor SEP firmware. The hacker, identified only as xerub, told Threatpost that the key unlocks only the SEP firmware, and that this would not impact user data. “Everybody can look and poke a...

Cross-site Scripting Vulnerability in Xiaoneng Online Customer Service

Xiaoneng Online Customer Service is a multi-channel, integrated online intelligent customer service platform. Xiaoneng Online Customer Service has a cross-site scripting vulnerability, which can be exploited by an attacker to insert malicious js code into the page and obtain user cookies and othe...

CAPTCHA Bypass Vulnerability in Genuine Technology APP Android Version

Chuangyuan Technology APP is a collection of intelligent property, intelligent parking, intelligent home, intelligent building control, green energy management and other intelligent park solutions, aiming to create intelligent office experience and life experience for all kinds of users in the pa...

Stored Cross-Site Scripting Vulnerability in Tea Bugs App

The Tea Bug app is a and a mobile software specially created for those who love tea culture. Tea Bug app has a stored cross-site scripting vulnerability. Allows an attacker to insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...