PT-2025-40413

Name of the Vulnerable Software and Affected Versions Flock Safety DetectionProcessing application version 6.35.33 Description The Flock Safety DetectionProcessing application for Android version 6.35.33, used on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices, includes...

CVE-2025-59403

The Flock Safety Android Collins app (com.flocksafety.android.collins) v6.35.31 for Android exposes unauthenticated administrative API endpoints on port 8080 (e.g., /reboot, /logs, /crashpack, /adb/enable) that control camera feed on Falcon, Sparrow, and Bravo devices. Root cause is lack of authe...

CVE-2025-59407

The CVE-2025-59407 entry affects Flock Safety DetectionProcessing for Android (version 6.35.33) on Falcon/Sparrow LPRs and Bravo Edge devices. The code bundles a Java Keystore (flock_rye.bks) with a hardcoded password (flockhibiki17); the keystore contains a private key, enabling potential privat...

CVE-2025-59406

The CVE-2025-59406 entry concerns the Flock Safety Pisco Android app (v6.21.11) installed on Falcon/Sparrow License Plate Readers and Bravo Edge AI Compute Devices. The root cause is a cleartext Auth0 client secret embedded in the client-side codebase, which can be extracted by decompiling or ins...

CVE-2025-59405

The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices contains a cleartext DataDog API key within in its codebase. Because application binaries can be trivially decompil...

CVE-2025-59407

The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices bundles a Java Keystore flockrye.bks along with its hardcoded password flockhibiki17 in its code. The keysto...

CVE-2025-57197

In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacker with root access to the device can dynamically instrument the app to bypass the current PIN verification check and directly modify the...

CVE-2025-56146

Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity...

CVE-2025-56146

Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity...

CVE-2025-56146

CVE-2025-56146 affects Indian Bank IndSMART Android App v3.8.1, with a missing SSL certificate validation flaw in the NuWebViewActivity. Affected software is the Indian Bank IndSMART Android App; the underlying cause is lack of SSL certificate validation in NuWebViewActivity, enabling potential m...

PT-2025-39203

Name of the Vulnerable Software and Affected Versions Indian Bank IndSMART Android App version 3.8.1 Description The Indian Bank IndSMART Android App version 3.8.1 exhibits a flaw related to missing SSL certificate validation within the NuWebViewActivity component. This could potentially allow fo...

CVE-2025-10718 Ooma Office Business Phone App com.ooma.office2 improper export of android application components

A vulnerability was found in Ooma Office Business Phone App up to 7.2.2 on Android. This affects an unknown part of the component com.ooma.office2. The manipulation results in improper export of android application components. The attack needs to be approached locally. The exploit has been made...

PT-2025-38587

Name of the Vulnerable Software and Affected Versions Webull Investing & Trading App version 11.2.5.63 Description A vulnerability exists in Webull Investing & Trading App that causes improper export of Android application components due to manipulation of unknown code within the...

PT-2025-38588

Name of the Vulnerable Software and Affected Versions SKTLab Mukbee App version 1.01.196 Description A vulnerability exists in SKTLab Mukbee App that results in improper export of android application components. The issue affects an unknown function within the AndroidManifest.xml file of the...

CVE-2025-5500

A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.xiaoxun.xunoversea.mibrofit. This manipulation causes improper export of android application components. The attack requires local access. T...

PT-2025-36783

Name of the Vulnerable Software and Affected Versions: ZhenShi Mibro Fit App version 1.6.3.17499 Description: A flaw exists in ZhenShi Mibro Fit App that causes improper export of Android application components. The issue impacts an unknown function within the AndroidManifest.xml file of the...

"Yahoo! Shopping" App for Android fails to restrict custom URL schemes properly

Overview "Yahoo! Shopping" App for Android provided by LY Corporation contains the following vulnerability. Improper authorization in handler for custom URL scheme CWE-939 - CVE-2025-41408 Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

CVE-2025-41408

Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attac...

CVE-2025-56139

LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata image, title, description when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different UR...

PT-2025-36110

Name of the Vulnerable Software and Affected Versions: Yahoo! Shopping App for Android versions prior to 14.15.0 Description: Improper authorization in the handler for a custom URL scheme in the Yahoo! Shopping App for Android may allow a remote, unauthenticated attacker to redirect a user to an...