ICSMA-21-196-01_Ypsomed mylife

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Ypsomed Equipment: mylife Cloud, mylife Mobile Application Vulnerabilities: Insufficiently Protected Credentials, Not Using an Unpredictable IV with CBC Mode, Use of Hard-coded Credentials 2. RISK...

Scholastic Online School App Has Logic Flaw Vulnerability

Scholastic Online School App is a mobile application that provides private customized courses for students and friends. A logic flaw vulnerability exists in Scholastic Online School APP, which can be exploited by attackers to obtain sensitive information...

CVE-2020-28713

Night Owl Smart Doorbell FW 20190505 is affected by CVE-2020-28713 due to incorrect access control in the push notification service (PNS). The web service does not authenticate requests, allowing remote attackers to send push notification events to a user’s mobile app by replaying or crafting fal...

CVE-2021-27941

Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application through 4.9.2 on Android and through 4.9.1 on iOS allows a physically proximate attacker to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring th...

CVE-2021-27941

The CVE-2021-27941 entry pertains to the eWeLink mobile application (QR code pairing mode) where unconstrained web access to the device’s private encryption key could let a physically proximate attacker monitor a device pairing process and eavesdrop on Wi‑Fi credentials and other sensitive inform...

TYPO3 Dynamic Content Element SQL注入漏洞

TYPO3 Dynamic Content Element is a mobile application from the Swiss company TYPO3. TYPO3 Dynamic Content Element has a SQL injection vulnerability, which stems from insufficient filtering of user-supplied data and can be exploited by attackers to inject SQL to obtain data-sensitive information...

Cosori Smart 5.8-Quart Air Fryer CS158-AF configuration server code execution vulnerability

Summary A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2020-14106

The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI 2021.01.26...

CVE-2020-14103

The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI 2020.01.15...

Information disclosure

The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI 2020.01.15...

CVE-2020-14106

The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI 2021.01.26...

CVE-2020-14103

The CVE-2020-14103 entry concerns Xiaomi MIUI OS (pre-2020.01.15) where an application on mobile devices can read the device SNO information, constituting an information-disclosure flaw. Connected sources (NVD and Red Hat/NVD mirroring, CNNVD/CVE records) confirm affected product family (Xiaomi M...

Testes de Codigo Elevation of Privilege Vulnerability

Testesdecodigogratis Testes de Codigo is a mobile application from Testesdecodigogratis in Portugal that provides users with driver's license learning. A security vulnerability exists in Testes de Codigo 11.4 and prior that allows an attacker to tamper with the Boolean values of the parameters...

SQL Injection Vulnerability in Jingteng Multimedia Co.

Jingteng Multimedia Corporation is a web design and mobile application company in Taiwan. A SQL injection vulnerability exists in the website builder system of Kington Multimedia Corporation, which can be exploited by attackers to obtain sensitive information from the database...

Samsung Pay mini information leakage vulnerability

Samsung Pay mini is a mobile application from Samsung South Korea. It provides a mobile payment function. An information disclosure vulnerability exists in the Samsung Pay mini application prior to v4.0.14, which allows unauthorized users to access balance information by scanning a specific QR co...

Janus Signature Vulnerability in App Store

Application Treasure is a mobile application acquisition platform created by Tencent Application Center for smartphone users. A Janus signature vulnerability exists in AppBao, which can be exploited by an attacker to gain control of the server...

eWeLink mobile application encryption issue vulnerability

IFTTT eWeLink is an IFTTT open source application. It provides remote switching of fans and lights, control of wind speed and dimming of lights. A security vulnerability exists in the eWeLink mobile application, which stems from weak encryption in fast pairing mode, and can be exploited by an...

Design/Logic Flaw

Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters "isAdmin" and "isPremium" located on device storage...

CVE-2021-25648

Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters "isAdmin" and "isPremium" located on device storage...

CVE-2021-25648

CVE-2021-25648 affects the mobile app Testes de Codigo (versions 11.4 and prior). The issue allows an attacker to gain access to the administrative interface and premium features by tampering the Boolean flags isAdmin and isPremium stored on the device, effectively enabling privilege escalation w...