Design/Logic Flaw

The Voatz application 2020-01-01 for Android allows only 100 million different PINs, which makes it easier for attackers after using root access to make a copy of the local database to discover login credentials and voting history via an offline brute-force approach...

Google: Efforts Against Bad Android Apps on Play Store Are Working

Some of the efforts Google has made over the past few years to bolster the security of Android app users as well as the mobile apps available on its Google Play store are starting to work, according to the tech giant. The company, which historically has struggled mightily to keep bad apps and...

CVE-2019-15615

A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past...

Security feature bypass

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries...

Design/Logic Flaw

A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past...

CVE-2019-15615

The CVE-2019-15615 entry concerns the Nextcloud Android app (v3.9.0). The root cause is a faulty check of the system time, allowing bypass of the lock protection when the device time is set to the past. Exploitation would let an attacker bypass the Passcode/Device credentials lock and access the ...

Android App "MyPallete" vulnerable to improper server certificate verification

Overview Android App "MyPallete" developed by NTT Data Corporation is used by several financial institutions as Android applications for their customers. "MyPallete" is vulnerable to improper server certificate verification CWE-295 and to improper host-matching validation CWE-297. Dai Nakamura of...

CVE-2020-5522

The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2020-8001

The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account...

CVE-2020-8001

The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account...

Rocket.Chat: API Keys Hardcoded in Github repository

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: API Keys is ha...

Open redirect

An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to an open redirect...

CVE-2019-8792

CVE-2019-8792 affects Shazam mobile apps (Android 9.25.0+, iOS 12.11.0+) where processing a crafted URL could trigger arbitrary JavaScript execution due to an injection issue stemming from insufficient URL/URL-scheme validation. The issue is addressed in Shazam Android 9.25.0 and iOS 12.11.0. Roo...

Audible has an unspecified vulnerability

Audible is an online playback application for audiobooks from the American company Audible. A security vulnerability exists in versions 2.34.0 and earlier of Audible, based on the Android platform, which stems from the program's failure to validate SSL credentials against Adobe SDKs. An attacker...

CVE-2019-11554

The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM attackers to cause a denial of service...

CVE-2019-19463

The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check...

Verizon, AT&T, Sprint and T-Mobile to replace SMS with RCS Messaging in 2020

Mobile carriers in the United States will finally offer a universal cross-carrier communication standard for the next-generation RCS messaging service that is meant to replace SMS and has the potential to change the way consumers interact with brands for years to come. All major United States...

DoorDash application for Android log message disclosure vulnerability

DoorDash application for Android is an online takeout application from DoorDash USA based on the Android platform. A log information disclosure vulnerability exists in the DoorDash application for Android version 11.5.2, which originates from the abnormal output of log files from a networked syst...

CVE-2019-17394

In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat...

CVE-2019-17398

In the Dark Horse Comics application 1.3.21 for Android, token information equivalent to the username and password is stored in the log during authentication, and may be available to attackers via logcat...