CVE-2019-17396

The CVE-2019-17396 entry concerns PowerSchool Mobile for Android (version 1.1.8). The underlying issue is that credentials (username and password) are logged during authentication and may be exposed to attackers via logcat. Affected component: authentication/logging path in the Android app. Impac...

CVE-2019-17396

In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat...

Syhunt Community 6.7 - Web And Mobile Application Scanner

Syhunt Community is a web and now mobile application security scanner. Syhunt is able to scan any kind of application source code for potential security vulnerabilities, pinpointing the exact lines of the code that need to be patched. Or you can simply enter a start URL and get detailed...

Canon PRINT 2.5.5 - Information Disclosure

Canon PRINT 2.5.5 - Information Disclosure Exploit Title: Content Provider URI Injection on Canon PRINT 2.5.5 CVE-2019-14339 Date: 24th July, 2019 Exploit Author: 0x48piraj Vendor Homepage:...

CVE-2019-5634 Hickory Smart Lock Insecure Logging on Android

An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy BLE from the mobile application are logged in...

CVE-2019-13143

An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the...

CVE-2019-9140 Happypoint mobile application information disclosure vulnerability

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

Burning down the house with IoT

For years we’ve been trying to set fire to ‘smart’ things by hacking them. We got some charring on the iKettle, but nothing more. Then we found some smart hair straighteners. The Glamoriser straighteners were promoted heavily on TV at Christmas; they piqued my interest because of the BLE...

Nextcloud: Some HTML Tags are Getting Executed in com.nextcloud.client

What is the Vulnerability? HTML Tags such as , , and are Getting Executed in Next Cloud Client Mobile Application for Android which can then Results to Code Injection. Reproduction Steps 1. Using Next Cloud Client Mobile App on Android, Rename a Folder to test Our HTML tag Was Executed F518303...

Tzumi Electronics Klic Lock Authentication Bypass

CVE-2019-11334 MIT License Copyright c 2019 Kerry Enfinger Python program to unlock any Tzumi Klic smart locks Model 5686 Firmware 6.2 May work on other smart locks Requires valid account email and password from Klic mobile application import argparse import requests import json from subprocess...

Haidian Driving School App Has Unauthorized Access Vulnerability

Haidian Driving School APP is a mobile driving test software launched by the official website of Haidian Driving School. Haidian Driving School APP has an unauthorized access vulnerability that can be exploited by attackers to view personal information...

Authentication flaw

The Android mobile application Halo Home before 1.11.0 stores OAuth authentication and refresh access tokens in a clear text file. This file persists until the user logs out of the application and reboots the device. This vulnerability can allow an attacker to impersonate the legitimate user by...

CVE-2019-5625

CVE-2019-5625 affects the Android Halo Home app prior to 1.11.0, where OAuth authentication and refresh tokens are stored in a clear text file. The file persists until logout or device reboot, enabling an attacker with physical access or a compromised app to impersonate the user by reusing the to...

CVE-2019-11511

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API...

Dynamic Web App has a logic flaw vulnerability

Movie.com APP is a mobile sports venue booking software. A logic flaw vulnerability exists in Movie.com APP, which can be exploited by an attacker to log in to any account to withdraw cash...

MyCar Controls uses hard-coded credentials

Overview The MyCar Controls mobile applications prior to v3.4.24 on iOS and prior to v4.1.2 on Android contains hard-coded admin credentials. Description MyCar is a small aftermarket telematics unit from AutoMobility Distribution Inc. MyCar add smartphone-controlled geolocation, remote start/stop...

A Mobile App Scanner is Not Just Another App

Mobile applications assist us mightily with our daily tasks. They increase our productivity with anywhere, anytime, high-functioning tools, and they help us communicate and share information with family members, friends, and co-workers. Every day, the rapidly evolving app market brings us more ap...

Unauthorized Access Vulnerability in Beijing Traffic Police APP

Beijing Traffic Police APP is used to handle traffic control business processing and information services. An unauthorized access vulnerability exists in Beijing Traffic Police APP. An attacker can exploit this vulnerability to obtain sensitive information...

Nextcloud: Predictable Random Number Generator

Description: The mobile application uses a predictable Random Number Generator RNG. Under certain conditions this weakness may jeopardize mobile application data encryption or other protection based on randomization. For example, if encryption tokens are generated inside of the application and an...

Nanjing Mapu Technology Co. Pocket University 1+4 Universal Program has a flawed logic vulnerability

Nanjing Mapu Technology Co. Pocket University 1+4 Universal Program is comprehensive mobile application service app. A logic flaw vulnerability exists in the Pocket University 1+4 Universal Program of Nanjing Mapu Technology Co. An attacker can exploit the vulnerability to obtain sensitive...