PT-2024-28799 · Unknown · Life: Personal Diary

Name of the Vulnerable Software and Affected Versions: Life: Personal Diary, Journal android app version 17.5.0 Description: An issue with access control in the Life: Personal Diary, Journal android app allows a physically proximate attacker to escalate privileges via the fingerprint authenticati...

CVE-2024-42041

The com.videodownload.browser.videodownloader aka AppTool-Browser-Video All Video Downloader application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component...

Talkatone com.talkatone.android application 安全漏洞

Talkatone com.talkatone.android application is an application for virtual phone calls from Talkatone, Inc. A security vulnerability exists in the Talkatone com.talkatone.android application, which originates from allowing any installed application without privileges to send a specially crafted...

CVE-2024-41999

Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerability is exploited, an attacker with physical access to the device may exploit the debug function to gain access to the OS functions, escalate the privilege, change the device's...

CVE-2024-42496

Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploited, an attacker with physical access to the device may retrieve the credential information and spoof the device to access the related external service...

CVE-2024-42496

Smart-tab Android app (affected component: plaintext storage of a password) is vulnerable to credential exposure if a device is physically accessed. The CVE description and connected sources indicate that storing passwords plaintext can allow an attacker with physical access to retrieve credentia...

PT-2024-29990 · Unknown · Smart-Tab Android App

Name of the Vulnerable Software and Affected Versions: Smart-tab Android app versions April 2023 or earlier Description: The issue concerns the storage of passwords in plaintext. If exploited, an attacker with physical access to the device may retrieve credential information and spoof the device ...

PT-2024-29682 · Unknown · Smart-Tab Android App

Name of the Vulnerable Software and Affected Versions: Smart-tab Android app versions prior to May 2023 Description: The issue concerns an active debug code vulnerability in the Smart-tab Android app. If exploited, an attacker with physical access to the device may use the debug function to acces...

JVN#42445661: Multiple vulnerabilities in Smart-tab

Smart-tab provided by TECHNO SUPPORT COMPANY is a multi-functional guest room tablet system for hotels and other accommodation facilities. Smart-tab contains multiple vulnerabilities listed below. Active debug code CWE-489 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 6.8 CVE-2024-41999...

BPL Medical Technologies PWS-01-BT and BPL Be Well Android Application

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.1 ATTENTION : Low attack complexity/public exploits are available Vendor : BPL Medical Technologies Equipment : PWS-01-BT, Be Well Android App Vulnerability : Cleartext Transmission of Sensitive Information 2. RISK EVALUATION Successful exploitation of...

Security Bulletin: IBM MaaS360 has identified a vulnerability in the MaaS360 MDM for Android Application (CVE-2024-35118)

Summary A vulnerability was identified and remediated in the IBM MaaS360 MDM for Android Application Version 8.60 and Prior Vulnerability Details CVEID:CVE-2024-35118 DESCRIPTION: IBM MaaS360 Android agent v 8.55 and lower is using hard coded credentials that can be obtained by a user with physic...

CVE-2024-45240

The TikTok aka com.zhiliaoapp.musically application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal in the application's exposed WebView. On Android 12 and later, this is only exploitable by third-party applications...

Google to Remove App that Made Google Pixel Devices Vulnerable to Attacks

A large percentage of Google's own Pixel devices shipped globally since September 2017 included dormant software that could be used to stage nefarious attacks and deliver various kinds of malware. The issue manifests in the form of a pre-installed Android app called "Showcase.apk" that comes with...

WAON service app for Android fails to verify SSL server certificates

Overview WAON service app for Android provided by AEON CO., LTD. fails to verify SSL server certificates. Gaku Taniguchi of RiskFinder,inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle...

CVE-2024-40096

The CVE-2024-40096 entry concerns com.cascadialabs.who (Who - Caller ID, Spam Block) app version 15.0 on Android, where sensitive information is written to the system log. The root cause is exposure through system logs, leading to potential confidentiality impact if logs are accessible. The docum...

"Piccoma" App uses a hard-coded API key for an external service

Overview "Piccoma" App for Android and "Piccoma" App for iOS provided by Kakao piccoma Corp. use a hard-coded API key for an external service CWE-798. Yoshihito Sakai of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Securit...

CVE-2024-6295

CVE-2024-6295 concerns the udn News Android APP, where the app stores the unencrypted user session in the local database after login. The connected CNNVD entry specifies that versions prior to 4.20.1 are affected, enabling a malicious app or an attacker with physical access to retrieve the sessio...

CVE-2024-6294 udn News App - Sensitive Information Exposure

udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn...

CVE-2024-35298

Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device. As a result, the user may become a victim of a phishing...

PT-2024-26422 · Unknown · Zozotown App For Android

Name of the Vulnerable Software and Affected Versions: ZOZOTOWN App for Android versions prior to 7.39.6 Description: The issue is related to improper authorization in the handler for a custom URL scheme, which allows an attacker to lead a user to access an arbitrary website via another applicati...