CVE-2023-32751

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript 1. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it i...

CVE-2023-32751

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript 1. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it i...

Aura - Python Source Code Auditing And Static Analysis On A Large Scale

Source code auditing and static code analysis Aura is a static analysis framework developed as a response to the ever-increasing threat of malicious packages and vulnerable code published on PyPI. Project goals: provide an automated monitoring system over uploaded packages to PyPI, alert on...

Aver EVC300 Firmware 00.10.16.36 Hardcoded Secrets Vulnerability

Aver EVC300 firmware version 00.10.16.36 suffers from having multiple hard-coded secrets that can allow for access bypass. Firmware for Aver EVC300 multipoint video conferencing system v00.10.16.36 and others as well as firmware for several other devices manufactured by Aver, potentially all...

Aver EVC300 Firmware 00.10.16.36 Hardcoded Secrets

Firmware for Aver EVC300 multipoint video conferencing system v00.10.16.36 and others as well as firmware for several other devices manufactured by Aver, potentially all multipoint video conferencing systems contains multiple advanced features that are not well documented: 1. The web admin server...

Pillaging AWS ECS Task Definitions for Hardcoded Secrets

The post Pillaging AWS ECS Task Definitions for Hardcoded Secrets appeared first on Rhino Security Labs...

CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this...

ReverseAPK - Quickly Analyze And Reverse Engineer Android Packages

Quickly analyze and reverse engineer Android applications. FEATURES: Displays all extracted files for easy reference Automatically decompile APK files to Java and Smali format Analyze AndroidManifest.xml for common vulnerabilities and behavior Static source code analysis for common vulnerabilitie...

My Telekom - Hardcoded secrets, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application My Telekom published at the 'play' market has multiple vulnerabilities...

Qwant - Customized SSL, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Qwant published at the 'play' market has multiple vulnerabilities...

Booking.com Hotels & Vacation Rentals - Hardcoded secrets, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Booking.com Hotels & Vacation Rentals published at the 'play' market has multiple vulnerabilities...

My Verisure - Customized SSL, Hardcoded secrets, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application My Verisure published at the 'play' market has multiple vulnerabilities...

Textra SMS - Dangerous filesystem permissions, Hardcoded secrets, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Textra SMS published at the 'play' market has multiple vulnerabilities...

BharatMatrimony - Matrimonial - Customized SSL, Hardcoded secrets, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application BharatMatrimony - Matrimonial published at the 'play' market has multiple vulnerabilities...

Privat24 - Customized SSL, Hardcoded secrets, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Privat24 published at the 'play' market has multiple vulnerabilities...

Signal Private Messenger - Dangerous filesystem permissions, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Signal Private Messenger published at the 'play' market has multiple vulnerabilities...

Kodi - GPL license, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Kodi published at the 'play' market has multiple vulnerabilities...

NBA app - Dangerous filesystem permissions, Exported ContentProvider, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application NBA app published at the 'play' market has multiple vulnerabilities...

Toshl Finance Budget & Expense - Base64 encoded String, Dangerous filesystem permissions, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Toshl Finance Budget & Expense published at the 'play' market has multiple vulnerabilities...

BEST Mumbai Bus Ticket & Pass - Customized SSL, Exported ContentProvider, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application BEST Mumbai Bus Ticket & Pass published at the 'play' market has multiple vulnerabilities...