309 matches found
smsofdeath
WAP Push Remote Modem Crash PoC Proof-of-concept Android app that sends a crafted 8-byte WAP Push PDU over SMS to a target handset. The malformed PDU triggers a NegativeArraySizeException in WapPushOverSms.decodeWapPdu, which goes uncaught in InboundSmsHandler and kills com.android.phone on the...
WapGuard
WAP Guard A tiny Android app that cleans up after the "SMS of Death" CVE-2026-58882: a malformed WAP Push SMS that crashes com.android.phone, drops calls, and stays queued so the crash repeats until the message is removed. WAP Guard does not prevent the crash , because only the Android security...
CLEANSTART-2024-CK05236 epan/dissectors/packet-wap
Security vulnerability affects the wireshark package. epan/dissectors/packet-wap...
Linux Distros Unpatched Vulnerability : CVE-2026-62280
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects...
CVE-2026-62280
Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...
CVE-2026-62280
Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...
EUVD-2026-78365
Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...
CVE-2026-62280
OpenAM versions 13.0.0 through 16.1.2 are vulnerable to reflected XSS in the OAuth2 authorize endpoint's display=wap consent page. Request-derived values are reflected through ConsentRequiredResource and the wap/authorize.ftl template without HTML escaping, allowing an attacker to execute arbitra...
CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...
CVE-2026-62280 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...
CVE-2026-62280: Improper Neutralization of Input During Web Page Generation
Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...
OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...
GHSA-VQXV-6XRH-49CP OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page
Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...
First Wap: A Surveillance Computer You’ve Never Heard Of
Mother Jones has a long article on surveillance arms manufacturers, their wares, and how they avoid export control laws: Operating from their base in Jakarta, where permissive export laws have allowed their surveillance business to flourish, First Wap's European founders and executives have quiet...
EUVD-2007-0792
Malware in sbrugna...
EUVD-2001-1546
Malware in sbrugna...
EUVD-2009-3106
Malware in sbrugna...
EUVD-2016-8839
Malware in sbrugna...