Restaurant Karaoke SHIDAX app for Android man-in-the-middle attack vulnerability

SHIDAX CORPORATION Restaurant Karaoke SHIDAX app for Android is a SHIDAX account management mobile application based on Android platform by SHIDAX CORPORATION in Japan. A security vulnerability exists in the Restaurant Karaoke SHIDAX app for Android 1.3.3 and earlier versions, which originates fr...

Google News and Weather application for Android security bypass vulnerability

Google News and Weather application for Android is a mobile application for the Android operating system based on the American company Google Google. The program supports pushing news and weather forecasts, etc. A security vulnerability exists in the Google News and Weather application for Androi...

CVE-2017-9245

The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack of SSL...

Zomato: [█████████] Hardcoded credentials in Android App

Authorization credentials for one of our development environments were hard coded in our Android App. We changed it as soon as this was reported. Thanks @gerbenjavado for reporting this. After decompiling the Zomato app I found basic HTTP credentials in the app. This sort of happend on accident...

CVE-2017-2172

Cross-site scripting vulnerability in Cybozu KUNAI for Android 3.0.0 to 3.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Communication message decryption vulnerability exists in the Voyager Android app

The Voyager Android app is a mobile app for buying airline tickets. A communication message decryption vulnerability exists in the TravelSense Android app. The vulnerability stems from fixed-key hardcoding, which can be exploited by an attacker to crack the encryption algorithm and break other...

CVE-2017-3749

CVE-2017-3749 affects Lenovo VIBE phones (Idea Friend Android app). The vulnerability allows private data to be backed up and restored via Android Debug Bridge, enabling tampering that leads to privilege escalation when exploited with CVE-2017-3748 and CVE-2017-3750. Connected sources also descri...

Design/Logic Flaw

The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a userid can be used to perform user actions...

CVE-2017-3215

The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a userid can be used to perform user actions...

CVE-2017-3215

The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of one year. This bearer token, in combination with a userid can be used to perform user actions...

Huacheng Gas Group Android APP has design flaws

Huacheng Gas Group Android APP is a client application that provides users with integrated management of remote meter reading and online bill payment. There is a design vulnerability in the verification code of Huacheng Gas Group Android APP. An attacker can use the vulnerability to reset any...

Kang Kang Smart Blood Pressure Monitor Android app has arbitrary user password reset vulnerability

KangKang Smart Blood Pressure Monitor Android app is a blood pressure management tool client that provides users with the convenience of measuring, recording, analyzing, and viewing. KangKang Smart Blood Pressure Monitor Android app has an arbitrary user password reset vulnerability, a remote...

Arbitrary Password Reset Vulnerability in Paco Drive Android App

BaGoDrive is an O2O online and offline taxi application based on LBS geographical location developed by Jiangsu Xunzhi Network Technology Co. There is an arbitrary password reset vulnerability in the BaGeDrivingTo Android app, which allows attackers to reset the password by using the other party'...

Wingstop's Android App has an overstepping vulnerability

Yonganxing App is a service platform that guides green shared mobility in the city. Yonganxing Android App suffers from an overstepping vulnerability, where an attacker utilizes the signature algorithm of the data communicated with the server side to overstep its authority to view other users'...

Bargo Travel Android App Has Arbitrary User Password Reset Vulnerability

Ba Ge Travel is a car time-sharing and leasing platform founded by Beijing Ba Ge Auto Leasing Co., Ltd. with the help of Internet of Things IoT technology and advanced operation mode, realizing the unattended, rent-and-return intelligent car mode, and is committed to providing users with 24-hour...

SAP Business One for Android 1.2.3 - XML External Entity Injection

SAP Business One for Android 1.2.3 - XML External Entity Injection Exploit Title: Blind XXE XML External Entityin SAP Date of Disclosure: 17/05/2017 Author: Ravindra Singh Rathore Vendor Homepage: https://www.sap.com/products/business-one.html Product - SAP Business One Android Application Versio...

CVE-2017-9045

The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a modified blocksv4.json file...

China Construction Bank's Android app suffers from weak certificate validation vulnerability

China Construction Bank Android APP is the mobile application product of China Construction Bank. China Construction Bank Android APP suffers from a weak certificate validation vulnerability, as the X509TrustManager validation function does not validate the server-side certificate. An attacker ca...

Tootsie Bus Android app suffers from a cracked sign signature algorithm leading to arbitrary phone number login vulnerability

Tuk Tuk Bus is a bus shuttle customization mobile service platform for people who have the same travel needs. The Tuk Tuk Bus Android app suffers from a cracked sign signature algorithm leading to an arbitrary cell phone number login vulnerability. An attacker can exploit this vulnerability to lo...

CVE-2017-2104

The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...