Music and Video for VK - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Music and Video for VK published at the 'play' market has multiple vulnerabilities...

VK.com: Checking whether user liked the media or not even when you are blocked

Poc : Take 2 accounts A and B 1. Now from A id make a random post say http://vk.com/id307083341?w=wall30708334136 2.Now from C id try to like the post of A . 3.Now from B id visit https://vk.com/dev/likes.getList 4. now put the owner id A and the post id == 307083341 which 36 in this case 5.and i...

VK.com: Внедрение произвольного javascript-сценария в функционале просмотра изображений мобильной версии сайта

Уязвимость существует из-за недостаточной обработки пользовательских данных, полученных из объекта location url, который используется в функции photo.fullscreen. Функция выполняется при активации события onclick, который срабатывается при клике на фотографию В настоящее время существует фильтраци...

VK Community - Filter Bypass & Persistent Vulnerability

Document Title: =============== VK Community - Filter Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1511 View Video: https://www.youtube.com/watch?v=S3lCQVx32Ho Release Date: ============= 2015-07-10 Vulnerability Laboratory ID VL-ID:...

VK Community - Filter Bypass & Persistent Vulnerability

Document Title: =============== VK Community - Filter Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1511 View Video: https://www.youtube.com/watch?v=S3lCQVx32Ho Release Date: ============= 2015-07-10 Vulnerability Laboratory ID VL-ID:...

CVE-2014-5920

The VK Amberfog aka com.amberfog.vkfree application 3.5.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The VK Amberfog aka com.amberfog.vkfree application 3.5.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5920

The CVE-2014-5920 entry concerns the VK Amberfog (com.amberfog.vkfree) Android app version 3.5.6 that fails to verify X.509 certificates from SSL servers. This creates an opportunity for MITM attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. The vulnerabil...

CVE-2014-5920

The VK Amberfog aka com.amberfog.vkfree application 3.5.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5822

The VK Kate Mobile aka com.perm.kate application 9.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The VK Kate Mobile aka com.perm.kate application 9.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5822

The CVE-2014-5822 entry concerns VK Kate Mobile (com.perm.kate) for Android (version 9.6.1) where SSL certificate verification is not performed. This root cause allows a man-in-the-middle to spoof servers and access sensitive data via crafted certificates. The connected documents corroborate the ...

CVE-2014-5822

The VK Kate Mobile aka com.perm.kate application 9.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Vk Gallery 1.1.0 - Shell Upload

The vk-gallery WordPress plugin was affected by a Shell Upload security vulnerability...

Nasty Covert Redirect Vulnerability found in OAuth and OpenID

After Heartbleed bug, a security flaw in widely used open-source software OpenSSL that puts countless websites at risk, another vulnerability has been found in popular authentication software OpenID and authorization software OAuth. Wang Jing, a Chinese mathematics Ph.D student at the Nanyang...

VK Social Network Open Redirect

Exploit Title :VK social network URL Redirector Abuse Vendor: www.vk.com Author: Juan Carlos Garca NightSec Blog: http://hackingmadrid.blogspot.com Facebook http://www.facebook.com/pages/ETHICAL-HACKING-Y-OL%C3%89-by-the-Face-WhiteHat/172393869485449?sk=app190322544333196 BREIF DESCRIPTION VK...

Wordpress Vk Gallery 1.1.0 File Upload

File upload vulnerability in Wordpress Vk Gallery plugin Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

WordPress Plugin timthumb.php Shell Upload

Exploit Title: Multiple Wordpress timthumb.php reuse vulnerabilities Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing --- Description --- The following Wordpress plugins reuse a vulnerable version of the timthumb.php library. By hosting a malicious GIF file...

Multiple WordPress Plugins - 'timthumb.php' File Upload

Exploit Title: Multiple Wordpress timthumb.php reuse vulnerabilities Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing --- Description --- The following Wordpress plugins reuse a vulnerable version of the timthumb.php library. By hosting a malicious GIF file...