Hacked0X90

A flaw was found in the CloudForms web interface where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms, including data such as newly created virtual machines.

The issue allows SQL injection through the content://wappush content provider in com.android.provider.telephony, found in some custom ROMs for Android phones. This enables an application without the READ SMS permission to read SMS messages.

The issue is related to an authentication bypass, allowing an attacker to access a specific URL of the affected product. This is due to improper verification of privileges, which may lead to information leaks.