Erez Yalon

The reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill, allowing an attacker to obtain transcripts of speech not intended for Alexa to process. This issue involves empty output-speech reprompts, custom wildcard input slots, and logging of detected speech. If a maliciously designed skill is installed, it could capture speech spoken within the device's hearing range.

The Themes App has a man-in-the-middle (MITM) issue due to the use of the insecure HTTP protocol for theme download. An attacker may exploit this to tamper with downloaded themes.

The issue concerns the unencrypted transmission of images in the Tinder app, which allows an attacker to extract private sensitive information by sniffing network traffic.

The issue allows an attacker to extract private sensitive information by sniffing network traffic due to fixed sizes of HTTPS responses.

The issue affects the call module, allowing an attacker to crash the call and data communication process by tricking a user into installing a malicious application. This application can send a given parameter to the call module, resulting in a denial of service.

The issue is due to improper design, allowing an attacker to trick users into installing a malicious app. This app can send HTTP requests and execute JavaScript code in web pages without obtaining the Internet access permission, potentially leading to resource occupation or information leak.

The issue affects the call module, allowing an attacker to crash the call and data communication process by tricking a user into installing a malicious application. This application can send a given parameter to the call module, resulting in a denial of service.

The issue is related to a resource exhaustion vulnerability due to a configuration setting. An attacker may trick a user into installing a malicious application, which can then turn on the device's flash-light and rapidly drain the device battery.