1855 matches found
SAP Business One for Android 1.2.3 - XML External Entity Injection
SAP Business One for Android 1.2.3 - XML External Entity Injection Exploit Title: Blind XXE XML External Entityin SAP Date of Disclosure: 17/05/2017 Author: Ravindra Singh Rathore Vendor Homepage: https://www.sap.com/products/business-one.html Product - SAP Business One Android Application Versio...
CVE-2017-9045
The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a modified blocksv4.json file...
China Construction Bank's Android app suffers from weak certificate validation vulnerability
China Construction Bank Android APP is the mobile application product of China Construction Bank. China Construction Bank Android APP suffers from a weak certificate validation vulnerability, as the X509TrustManager validation function does not validate the server-side certificate. An attacker ca...
Tootsie Bus Android app suffers from a cracked sign signature algorithm leading to arbitrary phone number login vulnerability
Tuk Tuk Bus is a bus shuttle customization mobile service platform for people who have the same travel needs. The Tuk Tuk Bus Android app suffers from a cracked sign signature algorithm leading to an arbitrary cell phone number login vulnerability. An attacker can exploit this vulnerability to lo...
CVE-2017-2104
The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Panda Driving Letter Android App Has Arbitrary Points Redemption Vulnerability
Panda Driving Letter is a traffic control and travel service software developed by Chengdu Digi Information Technology Co. Panda Driving Letter Android App has an arbitrary points exchange vulnerability. Due to a design flaw in the Panda Driving Letter Android app payment interface, an attacker c...
CVE-2016-1519
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...
CVE-2016-1519
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...
LeEco Zero Pie Enjoy Android app has an arbitrary account login vulnerability
ZeroPai Lexiang is an electric car time-share rental platform launched by LeTV Group. There is an arbitrary account login vulnerability in the Android app of LeTV ZeroPai Lexian. Due to design flaws in the cell phone SMS verification code login function, cracking the sign signature algorithm lead...
Arbitrary Password Reset Vulnerability in Kingsoft Wordsmith Android App
Kingsoft Wordsmith is a translation and learning software from Kingsoft Corporation. An arbitrary password reset vulnerability exists in Kingsoft wordmaster android app. Due to a design flaw in the feature of changing cell phone number, an attacker can reset the password of another person by only...
Driver's Choice Android app suffers from arbitrary account login vulnerability
Driving Chant is an electric car time-sharing platform developed by Spruce Wisdom. A vulnerability exists in the Driving Chant Android app. The vulnerability is due to a design flaw in the SMS verification code login function, which can be exploited by an attacker to log in to another person's...
Arbitrary User Password Reset Vulnerability in Kingsoft Wordsmith Android App
Kingsoft Wordsmith is a free translation and learning software from Kingsoft. Kingsoft wordmaster android app there is any user password reset vulnerability, the vulnerability arises from the change of password did not increase the verification of the old password due to the attacker can take...
Game Multi Android app has design flaws in password recovery feature
Game Multi app is a software that focuses on serving game users. Game Multi Android app has a vulnerability in the design of the password recovery function, which can be exploited by an attacker to change his password through another person's cell phone number, log in to the system and obtain...
Arbitrary Account Login Vulnerability in Dingtone Travel App
Dingtone Travel APP is a new energy car sharing platform based on internet technology. A design flaw vulnerability exists in the Dingtone Mobility Android APP's cell phone SMS verification code login function, allowing attackers to exploit the vulnerability to log in to another person's account...
Grab: Private Grab Messages on Android App can be accessed and cached by Search Engines
Description Hello. Today i discovered, that Search Engines can access the private users messages OTP pins, Group invites information etc. It happens because the https://grab-attention.grabtaxi.com host allows search indexing, and can leak the authtoken to the Search Engines which also can lead to...
Panda Car Android APP has arbitrary cell phone number login vulnerability
Panda Car Android APP is a car sharing software. The Panda Car Android APP suffers from an arbitrary cell phone number login vulnerability. The vulnerability allows an attacker to log in to another person's account using only their cell phone number...
CVE-2017-0547
An information disclosure vulnerability in libmedia in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other...
CVE-2017-2387
The Apple Music aka com.apple.android.music application before 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Jiangcheng Yi Bicycle Android APP cell phone SMS verification function has any cell phone number login vulnerability
Jiangcheng Easy Bike Android APP is a local intelligent public bicycle rental system for Wuhan. There is an arbitrary cell phone number login vulnerability in the SMS verification function of Jiangcheng Yi Bicycle Android APP. This allows an attacker to log in to another person's account by simpl...
