CVE-2017-13108

DFNDR Security Antivirus, Anti-hacking & Cleaner, 5.0.9, 2017-11-01, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

Code injection

Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication. This opens the application up to a man-in-the-middle attack having all of its encrypted traffic intercepted and read by an attacker...

CVE-2017-13105 Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication

Hi Security Virus Cleaner - Antivirus, Booster, 3.7.1.1329, 2017-09-13, Android application accepts all SSL certificates during SSL communication. This opens the application up to a man-in-the-middle attack having all of its encrypted traffic intercepted and read by an attacker...

CVE-2017-13107 Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption

Live.me - live stream video chat, 3.7.20, 2017-11-06, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

CVE-2017-13106 Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption

Cheetahmobile CM Launcher 3D - Theme, wallpaper, Secure, Efficient, 5.0.3, 2017-09-19, Android application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

Huawei Backup App - Mobile Reset Session Vulnerability

Document Title: =============== Huawei Backup App - Mobile Reset Session Vulnerability References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1987 Video: https://www.youtube.com/watch?v=YAW9yL1CoW8 Advisory:...

Lenovo Help Android app information disclosure vulnerability

Lenovo Help Android app is a Chinese Lenovo Lenovo application that provides online support for Lenovo products such as computers, cell phones and data centers. The app is mainly used to check device information and warranty status of Lenovo products, etc. A security vulnerability exists in the...

CVE-2018-12445

An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in...

Olive Tree Ftp Server application for Android Information Disclosure Vulnerability

Olive Tree Ftp Server application for Android is an application for building FTP servers on the Android platform. A security vulnerability exists in the Olive Tree Ftp Server application for Android platform. An attacker can exploit the vulnerability to access sensitive data...

Samsung Galaxy S7 Edge: Overflow in OMACP WbXml String Extension Processing(CVE-2018-10751)

OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the mobile network. One way to provision a device is via a WAP push SMS message containing provisioning information in WbXML. A malformed OMACP WAP push message can cause memory...

Werewolf Online Android App Information Leakage Vulnerability

Werewolf Online is a "werewolf" game for Android. Werewolf Online Android 0.8.8 suffers from an information leakage vulnerability, which can be exploited by an attacker to discover Firebase tokens via logcat output...

Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing

Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the mobile network. One way to provision a device is via a WAP push SMS message containing provisioning...

MakeMyTrip 7.2.4 - Information Disclosure Vulnerability

Exploit for Android platform in category local exploits Exploit Title: Android Application MakeMyTrip 7.2.4 - Unencrypted Database Files Software Link: MakeMyTrip v7.2.4 Android Application Exploit Author: Divya Jain Version: 7.2.4 Android App CVE: CVE-2018-11242 Category: Mobileapps Tested on:...

MakeMyTrip 7.2.4 - Information Disclosure

Exploit Title: Android Application MakeMyTrip 7.2.4 - Unencrypted Database Files Date: 2018-05-21 Software Link: MakeMyTrip v7.2.4 Android Application Exploit Author: Divya Jain Version: 7.2.4 Android App CVE: CVE-2018-11242 Category: Mobileapps Tested on: Android v5.1 1. Description Android...

Lenovo Help Android mobile app information disclosure vulnerability

Lenovo Help Android is an Android-based mobile application from Lenovo, a Chinese company, for getting support for Lenovo products. A security vulnerability exists in the Lenovo Help Android mobile application prior to version 6.1.2.0327, which can be exploited to obtain information over an HTTP...

CVE-2018-5298

In the Procter & Gamble "Oral-B App" aka com.pg.oralb.oralbapp application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences...

DuoLingo TinyCards application for Android Man-in-the-Middle Attack Vulnerability

DuoLingo TinyCards application for Android is a memory workout application based on the Android platform. A security vulnerability exists in versions of the DuoLingo TinyCards application for Android prior to version 1.0, which stems from the program's use of unencrypted HTTP, and can be exploite...

CVE-2017-17436

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

Code injection

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...

CVE-2017-17436

An issue was discovered in the software on Vaultek Gun Safe VT20i products. There is no encryption of the session between the Android application and the safe. The website and marketing materials advertise that this communication channel is encrypted with "Highest Level Bluetooth Encryption" and...