Lucene search
Hackapp.orgHACKAPP:COM.TEXTSMILEYS.MINIS.APKHistoryApr 01, 2016 - 9:26 a.m.
Text Smileys Minis ™ - Customized SSL, WebView code execution vulnerabilities
2016-04-0109:26:29
Hackapp.org
hackapp.com
7
HackApp vulnerability scanner discovered that application Text Smileys Minis ™ published at the ‘play’ market has multiple vulnerabilities.
Name
Text Smileys Minis ™Vendor
Text SmileysLink
COM.TEXTSMILEYS.MINIS.APKStore
playVersion
3.3- CRITICAL
- WebView code execution
WebView 'addJavascriptInterface' could be used to control the host app with JavaScript bindings. Remote Code Execution (RCE) is possible.
- Customized SSL
Check certificate validation. Do not create or redefine X509Certificate class methods by yourself, if you don't understand risks. Use the existing API.
- MEDIUM
- WebView JavaScript enabled
WebView 'setJavaScriptEnabled(true)' could be exploited during cross-site scripting attacks.
- WebView files access
Control of WebView context allows to access local files.
- NOTICE
- Unsafe deleting
All items deleted with 'file.delete()' could be recovered.
- External URLs
Were do they point?