39 matches found
CVE-2026-102670
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...
CVE-2026-102669
Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages...
CVE-2026-102671
The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...
CVE-2026-102668
The Joyland AI app accepts any TLS certificates from any server without validation...
CVE-2026-102667
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...
CVE-2026-102666
The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once...
CVE-2026-102671
The Joyland AI app is vulnerable because its invisible advertisement WebView accepts invalid SSL certificates by default. This flaw falls under CWE-295 (Improper Certificate Validation), potentially allowing for man-in-the-middle attacks within that specific WebView component. No specific version...
CVE-2026-102671 Joyland AI WebView accepts invalid SSL certificates
The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...
CVE-2026-102671 Joyland AI WebView accepts invalid SSL certificates
The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...
EUVD-2026-91030
The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...
EUVD-2026-91029
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...
CVE-2026-102670 Joyland AI enables HTTP
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...
CVE-2026-102670
The Joyland AI app is vulnerable because it explicitly permits cleartext HTTP traffic on devices running Android 9+ . This configuration deviates from the platform's default security behavior, which is to block such traffic, potentially exposing sensitive information during transmission. No speci...
CVE-2026-102670 Joyland AI enables HTTP
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...
CVE-2026-102669 Joyland AI hostname checking disabled
Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages...
CVE-2026-102669 Joyland AI hostname checking disabled
Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages...
EUVD-2026-91028
Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages...
CVE-2026-102669
The Joyland AI app is vulnerable to a security flaw because it does not verify hostnames . This improper validation of certificates with host mismatches (CWE-297) allows a malicious host to establish a connection or intercept chat messages . No specific exploit information or remediation details ...