Andmp | A blog about infosec, bug hunting and more!: MIUI

Home
about
contact

Andmp | A blog about infosec, bug hunting and more!

"Good artists copy; great artists steal."

Just another web hacking and vulnerability research blog that details how I use existing knowledge and old ways to discover new vulns ;)

My Vulnerability Disclosure Policy
About Me
InfoSec

Breaking

ad

Post Top Ad

Showing posts with label MIUI. Show all posts

Showing posts with label MIUI. Show all posts

Wednesday, 10 April 2019

[Unpatched Vulnerability] CVE-2019-11015: Lock Screen Auth Bypass leading to Sensitive Information Disclosure and an Improper Access Control issue in Xiaomi MIUI OS (latest stable releases affected)

nullptr April 10, 2019 1

By nullptr at April 10, 2019 1 comment:

Email This BlogThis!Share to Twitter Share to Facebook Share to Pinterest

Labels: advisory, CVE, Mi, MIUI, mobile security, security, sensitive information disclosure, unpatched vulnerability, Xiaomi

Older Posts Home

Post Bottom Ad

About Author

A Security Researcher and Bug Hunter based in India.

Author

Socialize

facebook count=3.5k;
Followers
twitter count=3.3k;
Followers
gplus count=735;
Followers
youtube count=2.8k;
Followers
pinterest count=524;
Followers
instagram count=849;
Followers

Blog Archive

▼ 2019 (7)
- ▼ May (1)
  - [Advisory] Unpatched URL Address Bar Spoofing Vuln...
- ► April (5)
- ► March (1)

► 2018 (7)
- ► December (1)
- ► November (1)
- ► September (1)
- ► August (2)
- ► February (1)
- ► January (1)

► 2017 (1)
- ► April (1)

Menu - Pages

Home

Recent

Popular

Xiaomi URL Address Bar spoofing w/ SSL vulnerability or, CVE-2019-10875 - Was it intentionally kept in the global versions by Xiaomi?

Introduction Are Chinese device makers on purpose making their software and OS insecure for international markets? Chinese manufactur...
[Advisory] Unpatched URL Address Bar Spoofing Vulnerability in UC Browser 12.11.2.1184 and UC Browser Mini 12.10.1.1192: With the same old one-liner payload...

Brief I discovered an URL Address Bar spoofing vulnerability in the latest version of the UC Browser 12.11.2.1184 and UC Browser Mini ...
The case of an unusual $10k worth content-based Blind SQLi in a Private Program

Blind SQL (Structured Query Language) injection is a type of SQL Injection attack that asks the database true or false questions and de...
[Unpatched Vulnerability] CVE-2019-11015: Lock Screen Auth Bypass leading to Sensitive Information Disclosure and an Improper Access Control issue in Xiaomi MIUI OS (latest stable releases affected)

So, as promised on Twitter, the wait ends, new security vulnerability full disclosure in Xiaomi! MiSRC team accepted and confirme...
How I managed to get an @Google.com email address, bypassing their previous patch!

The Google Bug Tracker helps them(Google) in tracking through different bugs and security issues, but Gopal, a highly skilled security re...

Comments

Archive

Sponsor

Technology

Tags

0day advisory android security beef projec beef xss framework Blind SQLi bug bounty bug bounty writeup Business logic bugs certification content based corporate secrets csrf CVE data leak First guy to crack OSCP at 17 google google issue tracker bug hacker hacking hacking google hostile subdomain takeovers Indiamart InfoSec internal panel Mi MIUI mobile security Offensive Security Certified Professional OffSec OSCP OSCP review penetration testing pentest PoC Reddit security security breach security certifications SECURITY RESEARCH security testing security vulnerability security writeup sensitive information disclosure SQL injection SSRF Subdomain takeovers ticket trick UC Browser UC Browser Security Advisory UC Browser security vulnerability unpatched vulnerability URL Address Bar Spoofing vulnerability vulnerability analysis vulnerability assessment vulnerability testing framework Xiaomi xiaomi browser 0day xiaomi browser vulnerability xiaomi security issue

Pages

Home

Tags

0day (1) advisory (1) android security (1) beef projec (1) beef xss framework (1) Blind SQLi (1) bug bounty (2) bug bounty writeup (1) Business logic bugs (1) certification (1) content based (1) corporate secrets (1) csrf (1) CVE (1) data leak (1) First guy to crack OSCP at 17 (1) google (1) google issue tracker bug (1) hacker (1) hacking (3) hacking google (1) hostile subdomain takeovers (1) Indiamart (1) InfoSec (2) internal panel (1) Mi (2) MIUI (1) mobile security (4) Offensive Security Certified Professional (1) OffSec (1) OSCP (1) OSCP review (1) penetration testing (2) pentest (1) PoC (1) Reddit (1) security (4) security breach (1) security certifications (1) SECURITY RESEARCH (1) security testing (3) security vulnerability (2) security writeup (2) sensitive information disclosure (1) SQL injection (1) SSRF (1) Subdomain takeovers (1) ticket trick (1) UC Browser (1) UC Browser Security Advisory (1) UC Browser security vulnerability (1) unpatched vulnerability (2) URL Address Bar Spoofing (1) vulnerability (2) vulnerability analysis (1) vulnerability assessment (1) vulnerability testing framework (1) Xiaomi (4) xiaomi browser 0day (2) xiaomi browser vulnerability (3) xiaomi security issue (3)

Connect With us

34.2k likes

Like

28.6k followers

Follow

8.6k subscribers

Subscribe

17.3k followers

+1

Recent News

About Me

An independent security researcher.
Learn More →

Contact Form

Name

Email *

Message *

Categories

Crafted with by TemplatesYard