{"hash": "b32a6f5564dc4788f47b2a5c153d2f3e5cdbd5c54400688ffd5fe92e4a04f496", "id": "HACKAPP:DE.WIRECARD.MOBILEWALLET.EPLUS.ANDROID.APK", "lastseen": "2016-09-26T20:43:37", "viewCount": 1, "hashmap": [{"hash": "9dabff87519d59eea7db2b7cf8f81dc9", "key": "affectedSoftware"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "d4be9c4fc84262b4f39f89565918568f", "key": "cvss"}, {"hash": "3a6d0d195c7758a200c3509c6f5a46df", "key": "description"}, {"hash": "c0dd5540d68a87d8f9e6f3533c9bffd9", "key": "hackapp"}, {"hash": "a66293771a2448b92256d41294e889e1", "key": "href"}, {"hash": "31b7bbe67d25314b59cac39c9a2aee0b", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "31b7bbe67d25314b59cac39c9a2aee0b", "key": "published"}, {"hash": "03c33493218202a6612c3c5672136d85", "key": "references"}, {"hash": "3b012aae1848bb95fe11f3cebae83cb0", "key": "reporter"}, {"hash": "36e3e49db54620a79813507309332fde", "key": "title"}, {"hash": "96e87ef1fcc8d9d3cdd337488987c423", "key": "type"}, {"hash": "cfcd208495d565ef66e7dff9f98764da", "key": "viewCount"}], "bulletinFamily": "software", "cvss": {"vector": "NONE", "score": 0.0}, "edition": 1, "enchantments": {"score": {"value": 5.0, "vector": "NONE"}, "vulnersScore": 5.0}, "type": "hackapp", "description": "HackApp vulnerability scanner discovered that application Walletcard published at the 'play' market has multiple vulnerabilities.", "title": "Walletcard - Customized SSL, WebView SSL handling enabled vulnerabilities", "history": [], "objectVersion": "1.2", "cvelist": [], "published": "2016-04-01T09:02:13", "hackapp": {"icon": "http://lh3.ggpht.com/QKHgNXh06mtM1ojiGz2Tgg_gyDyYj8JdmYS-XbEXR2H_zBAYnwc8s0yHyt-iZdCsBg9i=w300", "store": "play", "release": "2014-09-01T00:00:00", "apk": "DE.WIRECARD.MOBILEWALLET.EPLUS.ANDROID.APK", "version": "1.4", "name": "Walletcard", "vendor": "Wirecard Technologies GmbH", "bugs": [{"description": "\n\t\t\tCheck certificate validation. Do not create or redefine X509Certificate class methods by yourself, if you don't unterstand risks. Use the existing API.\n\t\t\t", "name": "Customized SSL", "id": "4aaf45ef30ec4228d66f586eb34e7cf2", "severity": "critical"}, {"description": "Are you sure these files should be here?", "name": "Suspicious files", "id": "04f4c0780e6f68f492565229d41b1a1c", "severity": "notice"}, {"description": "All items deleted with 'file.delete()' could be recovered.", "name": "Unsafe deleting", "id": "cd524a463b63ebbf856b7190f0b56dfd", "severity": "notice"}, {"description": "Native code (.so) usage 'System.loadLibrary();' is found.", "name": "Native code usage", "id": "7021335c87f679ba1ca2b7a310136d06", "severity": "notice"}, {"description": "SD-cards and other external storages have 'worldwide read' policy.", "name": "SD-card access", "id": "8c4cac214483daaf8ce429e5990d3443", "severity": "medium"}, {"description": "These credentials could be used for authentication.", "name": "Certificates or keys found", "id": "195de71bee3a9133e920a806cefb69e1", "severity": "medium"}, {"description": "The app uses Android KeyStore subsystem.", "name": "KeyStore usage", "id": "2a37ce141bee019ebe45dc2aefa38924", "severity": "notice"}, {"description": "Control of WebView context allows to access local files.\n\t\t\t", "name": "WebView files access", "id": "02ca0fe85a2257fc2d28540caefdd1c5", "severity": "medium"}, {"description": "Function 'Runtime.getRuntime().exec()' is used, please check where variables are come from.", "name": "Runtime command execution", "id": "e339611af101a03bed3eac62dd97e7d6", "severity": "medium"}, {"description": "Were do they point?", "name": "External URLs", "id": "411a7a9e634f89aa42683607f12cf600", "severity": "notice"}, {"description": "WebView with 'handler.proceed();' allows connection to continue even if the SSL certificate validation is failed.", "name": "WebView SSL handling enabled", "id": "2d9fe879e4df606a363af1b60cbaa87e", "severity": "critical"}, {"description": "WebView 'setJavaScriptEnabled(true)' could be exploited during cross-site scripting attacks.", "name": "WebView JavaScript enabled", "id": "17be8575250cb68c623984c468ce6229", "severity": "medium"}], "link": "https://play.google.com/store/apps/details?id=de.wirecard.mobilewallet.eplus.android&hl=en"}, "references": ["https://play.google.com/store/apps/details?id=de.wirecard.mobilewallet.eplus.android&hl=en"], "reporter": "Hackapp.org", "affectedSoftware": [{"version": "1.4", "name": "Walletcard", "operator": "le"}], "modified": "2016-04-01T09:02:13", "href": "https://hackapp.com/report/baa254e61887c6eb1be95cc04714eb29"}

{}