Xiaofeng Air Ching App for Android suffers from arbitrary account password reset vulnerability

Xiaofeng Air Dorje APP is the APP developed by Shenzhen Xiaofeng Technology Co., Ltd. to work with Xiaofeng Air Dorje system, mainly used to monitor the indoor air quality and Xiaofeng Air Dorje internal and external machine operation status, monitoring items including PM2.5, formaldehyde, oxygen...

Unauthorized Access Vulnerability in Xiao Feng Air Ching App Android Version

Ltd. developed with the work of the Xiao Feng Air Dorothy system APP, mainly used to monitor the indoor air quality and Xiao Feng Air Dorothy internal and external machine running status, monitoring items including PM2.5, formaldehyde, oxygen, temperature and humidity, and can be through the APP...

Smart Heat Temperature Control App for Android suffers from an override access vulnerability

Smart Heat Temperature Control APP a home temperature control software, users only need to add the home's Internet-accessible thermostat to the software, you can use your phone or tablet to control the temperature of your home's HVAC equipment. The Android version of Smart Heat Temperature Contro...

Xiaofeng Air Ching App for Android has an overstepping loophole

Ltd. developed with the work of the Xiao Feng Air Dorothy system APP, mainly used to monitor the indoor air quality and Xiao Feng Air Dorothy internal and external machine running status, monitoring items including PM2.5, formaldehyde, oxygen, temperature and humidity, and can be through the APP...

VK.com: Stealing Private Information in VK Android App through PlayerProxy Port Remotely

Incorrect interaction with the network...

HEYI Intelligent Alarm System Android APP has malicious bulk registration vulnerability

HEYI Smart Alarm System Android APP is a smart alarm APP that integrates security class monitoring, firmware upgrade, smart extension and so on. HEYI Smart Alarm System Android APP has a malicious bulk registration vulnerability, attackers can bulk register accounts by grabbing packet data to...

Vauxhall General Management Android App has SMS Bombing Vulnerability

Wojia General Manager Android APP is a home control software. There is an SMS bombing vulnerability in Wojia Total Management Android APP. Attackers can bombard the client with SMS messages by utilizing the forget password function...

Logic design flaws in Vogelmaster's Android app

Wojia General Manager Android APP is a home control software. There is a logic design vulnerability in Wojia General Management Android APP. An attacker can exploit the vulnerability to modify arbitrary payment amount...

Rimet Wifi Smart Temperature Control Android APP has an override access vulnerability

Rimet Wifi Smart Temperature Control Android APP is a management platform for smart hardware devices. Rimet Wifi Intelligent Temperature Control Android APP has an override access vulnerability. After logging into the client, the attacker can obtain sensitive information such as patient's name,...

Mitsui Sumitomo Insurance SumaHo application for Android certificate validation vulnerability

Mitsui Sumitomo Insurance SumaHo application for Android is an Android-based insurance product management application from Mitsui Sumitomo Insurance in Japan. A certificate validation vulnerability exists in versions 3.0.0 and earlier of the Mitsui Sumitomo Insurance SumaHo application for Androi...

Unauthorized Access Vulnerability in Goodbody Knowledge Android APP of Tongfang Co.

Good Body Knowledge Android App is a software to detect the health data in your body. There is an override access vulnerability in the Good Body Knowledge Android APP of Tongfang Co. The attacker registers and logs into the system while grabbing packets and modifying the user ID to query any user...

Arbitrary Account Password Reset Vulnerability in Goodbody Knowledge Android APP of Tongfang Co.

Good Body Knowledge Android App is a software to detect the health data in your body. An arbitrary account password reset vulnerability exists in the Good Body Knowledge Android APP of Tongfang Co. An attacker can reset any account password by grabbing a packet to obtain a verification code throu...

Lenovo Service Framework Android Code Execution Vulnerability

Lenovo Service Framework Android application is a special application for Lenovo products based on the Android platform from China Lenovo Lenovo Company. A security vulnerability exists in the Lenovo Service Framework Android application, which originates from the program using an insecure set of...

CVE-2017-15997

In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML fi...

CVE-2017-15999

CVE-2017-15999 affects the Android app NQ Contacts Backup & Restore (version 1.1). The root issue is transmission of credentials without HTTPS: during login, the username is sent in cleartext together with an SHA-1 hash of the password. This enables an attacker to crack the password hash or reuse...

CVE-2017-15999

In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attack...

CVE-2017-15581

In the "Diary with lock" aka WriteDiary application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive...

Private Internet Access (PIA) Android App Denial of Service Vulnerability

Private Internet Access PIA is a commercial VPN service operated by London Trust Media. A denial of service vulnerability exists in the London Trust Media Private Internet Access PIA Android app prior to version 1.3.3.1. Via a large VPN server list file, a remote attacker can exploit this...

Password Bypass Vulnerability in Yoosee APP for Android

Yoosee is a free APP customized for the new generation of smart home products by Shenzhen GW Times, which adopts the advanced Cloudlink P2P network transmission technology. There is a password bypass vulnerability in the Android version of Yoosee APP, which can be exploited by an attacker to...

Yikang to Home Android APP has arbitrary cell phone number login vulnerability

Yikang to Home Android APP is mobile online pharmacy shopping software. There is an arbitrary cell phone number login vulnerability in Yikang to Home Android APP. An attacker can log in to any account by capturing a packet and obtaining a verification code...