865 matches found
CVE-2021-25648
CVE-2021-25648 affects the mobile app Testes de Codigo (versions 11.4 and prior). The issue allows an attacker to gain access to the administrative interface and premium features by tampering the Boolean flags isAdmin and isPremium stored on the device, effectively enabling privilege escalation w...
CVE-2020-25493
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic...
CVE-2020-25493
The CVE-2020-25493 entry concerns Oclean Mobile Application 2.1.2, which communicates with an external site over HTTP. The vulnerability description states that HTTP payloads are encrypted with a hardcoded XOR key, creating a pathway for potential traffic decoding and eavesdropping. Connected sou...
Oclean Mobile Application Encryption Issue Vulnerability
An encryption issue vulnerability exists in Oclean Mobile Application, which arises from a network system or product that does not properly use the relevant cryptographic algorithms, resulting in content that is not properly encrypted, weakly encrypted, and sensitive information stored in plainte...
Epikur License Issues Vulnerability
Epikur is a healthcare mobile application from German company Epikur that provides users with psychotherapy, patient management and other features. An authorization issue vulnerability exists in Epikur versions prior to 20.1.1 that stems from an administrator account accessing the default...
Red Hat Mobile Aplication Platform Input Validation Error Vulnerability
Red Hat Mobile Aplication Platform is a mobile application development platform from Red Hat, Inc. The application orchestrates large-scale mobile application development plus supports everything from pre-packaged, no-code mobile solutions to fully customized solutions to mobile-integrated...
CVE-2021-25647
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
CVE-2021-25647
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
Cross site scripting
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
CVE-2021-25647
CVE-2021-25647 affects the mobile application “Testes de Codigo” up to version v11.3. The issue is a stored XSS in the feedback message field: payloads are stored in the remote database and later executed on client devices when loading the feedback list (via website or app). The available connect...
CVE-2021-25647
Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to be stored in the remote database and leading to its execution on client devices when loading the "feedback list", either by accessing the website directly o...
Red Hat Mobile Aplication Platform 输入验证错误漏洞
Red Hat Mobile Aplication Platform is a mobile application development platform from Red Hat, Inc. The application orchestrates large-scale mobile application development plus supports everything from pre-packaged, no-code mobile solutions to fully customized solutions to mobile-integrated...
Shopify: Store Deletion or Sell without authentication
In order for an owner to "close or sell" the store, a password is required in order to confirm the decision, when the action is applied in the web application. It was identified that the mobile application doesn't require credentials in order to perform the same action, thus by navigating to the...
Multiple Sooil Product License Issue Vulnerabilities
Sooil Dana Diabecare RS and others are products of Sooil Korea.Sooil Dana Diabecare RS is a smart insulin pump with discrete remote control for medical use.Sooil Anydana-i is a mobile application that can be used to control the Sooil Dana Diabecare RS.Sooil Anydana-i is a mobile application that...
Win911 Enterprise Elevation of Privilege Vulnerability
Win911 Enterprise is a mobile application from Win911 USA that allows information interaction with industrial equipment. An elevation of privilege vulnerability exists in Win-911 Enterprise version V4.20.13, which can be exploited by an attacker to override various executable programs, which coul...
Win911 Enterprise 安全漏洞
Win911 Enterprise is a mobile application from Win911 USA that allows information interaction with industrial equipment. An elevation of privilege vulnerability exists in Win-911 Enterprise version V4.20.13, which can be exploited by an attacker to override various executable programs, which coul...
CVE-2020-27199
The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the application currently has in place is a simple Username and Password authentication function. Using enumeration, an attacker is able to forge a User specific token without the need for...
CVE-2020-27199
CVE-2020-27199 affects Magic Home Pro on Android (1.5.1). The issue is an Authentication Bypass enabling full control of a victim’s device group via token forgery and endpoint enumeration. Attack chain described includes: (1) enumerate bound users by mac address to obtain userName/userUniID/binde...
Magic Pro Home License Issue Vulnerability
Magic Pro Home is a mobile software from China-based Magic Pro that allows intelligent control of LED light illumination. A security vulnerability exists in Magic Pro Home application 1.5.1, which stems from allowing authentication to be bypassed. The application currently has security controls...