Opensecurity Mobile Security Framework

Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files

Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS Rebinding

Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Local Privilege Escalation in MobSF

Stored Cross-Site Scripting (XSS) in MobSF

Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.

Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.

MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)

Mobile Security Framework (MobSF) bypass of SSRF fix

Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

MobSF has SQL Injection in its SQLite Database Viewer Utils

Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check

Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect

Partial Denial of Service (DoS) in MobSF

MobSF Path Traversal in GET /download/<filename> using absolute filenames