CVE-2017-5249: Insecure Storage of Sensitive Information

In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...

PT-2018-8243

Name of the Vulnerable Software and Affected Versions: Insteon for Hub Android app versions 1.9.7 and prior Description: The issue concerns the insecure storage of the OAuth token used for authorizing user access. This token is not stored in an encrypted and secure manner, potentially exposing us...

CVE-2017-16835

The "Photo,Video Locker-Calculator" application 12.0 for Android has android:allowBackup="true" in AndroidManifest.xml, which allows attackers to obtain sensitive cleartext information via an "adb backup '-f smart.calculator.gallerylock'" command...

Place Life Travel Photography Software Android App Has Logic Flaw Vulnerability

Place is a photo socialization software based on location tagging. Place life travel photography software Android APP has a brute force vulnerability that can be exploited by attackers to blast account password information...

Code injection

Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic...

CVE-2018-6017: Cleartext Transmission of Sensitive Information

Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network traffic...

CVE-2018-6018: Cleartext Transmission of Sensitive Information

Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic...

PT-2018-17301

Name of the Vulnerable Software and Affected Versions Tinder iOS app affected versions not specified Tinder Android app affected versions not specified Description The issue allows an attacker to extract private sensitive information by sniffing network traffic due to fixed sizes of HTTPS...

PT-2018-17300

Name of the Vulnerable Software and Affected Versions Tinder iOS app affected versions not specified Tinder Android app affected versions not specified Description The issue concerns the unencrypted transmission of images in the Tinder app, which allows an attacker to extract private sensitive...

HPSBGN03577 rev 1 - Exposure of Application Configuration Details - Tommy Hilfiger TH24/7 Android app

Potential Security Impact Information exposure of application configuration. Reported By: Akshay Jain VULNERABILITY SUMMARY A potential security vulnerability caused by incomplete obfuscation of application configuration information was discovered. HP has no access to customer data as a result of...

Nootka App for Android vulnerable to OS command injection

Overview Nootka App for Android provided by SeeLook contains an OS command injection vulnerability CWE-78. Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

CVE-2018-5298

In the Procter & Gamble "Oral-B App" aka com.pg.oralb.oralbapp application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences...

CVE-2017-16905

The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack...

Tamper-Detection App for Android

Edward Snowden and Nathan Freitas have created an Android app that detects when it's being tampered with. The basic idea is to put the app on a second phone and put the app on or near something important, like your laptop. The app can then text you -- and also record audio and video -- when...

Coremail's Android version suffers from an override access vulnerability.

Coremail Lobbyist Email System for Android is a mobile email app. There is an over-authorized access vulnerability in the "Personal Details" page of Coremail Lonker Mailbox System for Android. It allows attackers to utilize the vulnerability to modify the list field to query the name, cell phone...

Telegram Messenger Directory Traversal Vulnerability

Telegram Messenger is a cross-platform instant messaging program whose client is free and open source software, but whose server is proprietary software. A directory traversal vulnerability exists in the saveFile method in MediaController.java in the Telegram Messenger Android application. An...

CVE-2017-3190

Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

CVE-2017-15530

Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that attackers will attempt to exploit as a first pass across the application. As they probe the application they will take note of anything that m...

CVE-2017-15529

Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service DoS exploit. A DoS attack is a type of attack whereby the perpetrator attempts to make a particular device unavailable to its intended user by temporarily or indefinitely disrupting services of a specific...

Information disclosure

Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that attackers will attempt to exploit as a first pass across the application. As they probe the application they will take note of anything that m...