Input validation

Improper input validation in the IntelR Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable denial of service via local access...

CVE-2023-25772

The CVE-2023-25772 issue affects Intel(R) Retail Edge Mobile Android app prior to version 3.0.301126-RELEASE, caused by improper input validation. An authenticated user could potentially trigger a local-denial-of-service. Remediation: update to 3.0.301126-RELEASE or newer. Exploit details are not...

CVE-2023-28932

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin = 11.20 versions...

CVE-2023-28932 WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin = 11.20 versions...

CVE-2023-28932

CVE-2023-28932 affects the WPMobile.App WordPress plugin (Android/iOS app) version

Mitel MiCollab Authentication Error Vulnerability

Mitel MiCollab is a mobile application from Mitel Canada that provides voice, video, messaging, audio conferencing and team collaboration for employees. The Mitel MiCollab suffers from an authentication error vulnerability that stems from a faulty authentication control in the Web conferencing...

How to Create a Mobile Application for Android OS Step by Step?

By Owais Sultan Android OS is available on 3.3 billion devices in 190 countries across the globe, making Android app development… This is a post from HackRead.com Read the original post: How to Create a Mobile Application for Android OS Step by Step?...

Hardcoded credentials

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server MQTT server and the ability to remotely control garage door...

CVE-2023-22702

Auth. contributor+ Cross-Site Scripting XSS vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin = 11.13 versions...

CVE-2023-22702

CVE-2023-22702 affects the WordPress WPMobile.App plugin for Android/iOS. The vulnerability exists in WPMobile.App versions

PT-2023-14726 · Bofei · Bofei Dbd+ Application

Name of the Vulnerable Software and Affected Versions: BOFEI DBD+ Application for IOS & Android version 1.4.4 Description: An insecure password reset issue was discovered in the BOFEI DBD+ Application for IOS & Android service due to an insecure expiry mechanism. Recommendations: For version 1.4....

CVE-2022-43704

The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is possible to replay Sinilink aka SINILINK521 protocol udp/1024 commands interfacing directly with the target device. This, in turn, allows for...

Design/Logic Flaw

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

CVE-2022-4457 WARP client manifest misconfiguration leading to Task Hijacking

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

CVE-2022-4457

Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's...

Abode Systems, Inc. iota All-In-One Security Kit XCMD setAlexa OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1558 Abode Systems, Inc. iota All-In-One Security Kit XCMD setAlexa OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-33189 SUMMARY An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. io...

Shopify: URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution

A vulnerability in the Shopify mobile application allowed bypassing URL scheme validation in the NavigationActivity component. Attackers could craft malicious URLs using data: or javascript: schemes to execute JavaScript code within the app's webview context...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

mIPC camera 安全漏洞

The mIPC camera is a series of cameras from mIPC. A security vulnerability exists in mIPC camera firmware version 5.3.1.2003161406. An attacker exploiting this vulnerability could obtain remote code execution on the camera while the victim is logged into a specially crafted mobile application...

CVE-2022-37709

Tesla Model 3 V11.02022.4.5.1 6b701552d7a6 Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing. Tesla Model 3's Phone Key authentication is vulnerable to Man-in-the-middle attacks in the BLE channel. It allows attackers to open a door and drive the car away by leveraging...