AppCMS Cross-Site Scripting Vulnerability (CNVD-2022-08032)

AppCMS is a content management system CMS for mobile application downloads. a cross-site scripting vulnerability exists in AppCMS, which stems from the lack of proper validation of client-side data in the WEB application. An attacker could exploit this vulnerability to execute client-side code...

Banco Guayaquil 8.0.0 Cross Site Scripting

Document Title: =============== Banco Guayaquil Versión 8.0.0 IOS - Cross Site Scripting Stored Credits & Authors: ================== TaurusOmar - @TaurusOmar [email protected] taurusomar.com Vendor Homepage: https://apps.apple.com/ec/app/banco-guayaquil/id624963066 =============== Release...

Crater Invoice Crater 代码问题漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. Crater Invoice crater suffers from a code issue vulnerability that stems from the unrestricted upload of dangerous types o...

CVE-2021-3179

GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass...

CVE-2021-43388

Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag in the manifest is False...

Design/Logic Flaw

Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag in the manifest is False...

CVE-2021-43388

CVE-2021-43388 affects the Unisys Cargo Mobile App prior to version 1.2.29. The vulnerability stems from storing sensitive information in cleartext, which could be exposed if backups are accessed. The cited fix is to set the manifest’s allowBackup flag to False to prevent backup of sensitive data...

CVE-2021-43388: Cleartext Storage of Sensitive Information

Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ensuring that the allowBackup flag in the manifest is False...

PT-2021-23824

Name of the Vulnerable Software and Affected Versions Unisys Cargo Mobile Application versions prior to 1.2.29 Description The issue concerns the storage of sensitive information in cleartext, which could be exposed through a backup. This is addressed by setting the allowBackup flag in the manife...

HealthForYou 1.11.1 / HealthCoach 2.9.2 Missing Password Policy Vulnerability

HealthForYou version 1.11.1 and HealthCoach version 2.9.2 are missing a server-side password policy. When creating an account or changing your password the mobile and web application both check the password against the password policy. But the API assumes that the given password is already checke...

CVE-2021-25507

CVE-2021-25507 describes an improper authorization vulnerability in the Samsung Flow mobile app before version 4.8.03.5. The issue enables a Samsung Flow PC application connected to the user device to access part of notification data housed in Secure Folder without authorization. The available re...

CVE-2021-40527

Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote attacker to access developer files stored in an AWS S3 bucket, by reading credentials stored in plain text within the mobile application...

CVE-2021-40527

CVE-2021-40527 affects the Android AWS SDK (and related app code) in versions up to 1.7.22, including the com.onepeloton.erlich mobile app. The underlying issue is storage of credentials in plaintext within the mobile application, allowing a remote attacker to read AWS S3 developer files stored i...

CVE-2021-40498

A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is...

Code injection

A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is...

CVE-2021-40498

A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is...

CVE-2021-40498: Undefined Security Weakness

A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service, which can lead to denial of service. The vulnerability is...

PT-2021-22904

Name of the Vulnerable Software and Affected Versions SAP SuccessFactors Mobile Application for Android versions older than 2108 Description A vulnerability has been identified that allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service...

Tips & Tricks for Unmasking Ghoulish API Behavior

I was analyzing one of my customer’s API traffic the other day and I noticed something odd about the devices that were using the mobile application API. I found standard browsers like Firefox and Chrome hitting API endpoints that should only be touched by their mobile-application communication. I...

Fish Hunt FL 信息泄露漏洞

Fish Hunt FL is used to manage Florida hunting and fishing licenses. An information disclosure vulnerability exists in Fish Hunt FL that stems from an insecure direct object vulnerability in the hunting/fishing license retrieval functionality of the Fish | Hunt FL iOS app version 3.8.0 release an...