Security feature bypass

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries...

CVE-2019-15615

The CVE-2019-15615 entry concerns the Nextcloud Android app (v3.9.0). The root cause is a faulty check of the system time, allowing bypass of the lock protection when the device time is set to the past. Exploitation would let an attacker bypass the Passcode/Device credentials lock and access the ...

CVE-2019-15622

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries...

CVE-2019-15615

A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past...

CVE-2019-15622: Improper Neutralization of Special Elements used in an SQL Command

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries...

PT-2020-9746

Name of the Vulnerable Software and Affected Versions Nextcloud Android app version 3.6.0 Description The issue is related to insufficient sanitization in the Nextcloud Android app, allowing an attacker to obtain content information from protected tables when custom queries are used...

PT-2020-9738

Name of the Vulnerable Software and Affected Versions Android App version 3.9.0 Description The issue is caused by a wrong check for the system time, allowing a bypass of the lock protection when the system time is changed to the past. Recommendations For Android App version 3.9.0, update to a...

CVE-2019-15615: Improper Access Control

A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to the past...

Android App "MyPallete" vulnerable to improper server certificate verification

Overview Android App "MyPallete" developed by NTT Data Corporation is used by several financial institutions as Android applications for their customers. "MyPallete" is vulnerable to improper server certificate verification CWE-295 and to improper host-matching validation CWE-297. Dai Nakamura of...

CVE-2020-5522

The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2020-5522

The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2020-8001

The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account...

CVE-2020-8001

The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account...

CVE-2020-7999

The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOADAPIKEY and FILEDOWNLOADAPIKEY...

CVE-2020-8001

The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account...

Rocket.Chat: API Keys Hardcoded in Github repository

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: API Keys is ha...

Open redirect

An issue existed in the parsing of URL schemes. This issue was addressed with improved URL validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to an open redirect...

CVE-2019-8792

CVE-2019-8792 affects Shazam mobile apps (Android 9.25.0+, iOS 12.11.0+) where processing a crafted URL could trigger arbitrary JavaScript execution due to an injection issue stemming from insufficient URL/URL-scheme validation. The issue is addressed in Shazam Android 9.25.0 and iOS 12.11.0. Roo...

PT-2019-19220

Name of the Vulnerable Software and Affected Versions Shazam Android App versions prior to 9.25.0 Shazam iOS App versions prior to 12.11.0 Description The issue concerns an injection problem that has been addressed through improved validation. Processing a maliciously crafted URL may lead to...

CVE-2019-8792: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An injection issue was addressed with improved validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...