Fxizenta

A flaw exists in the UCC CampusConnect App for Android, specifically affecting the code within the campusconnect/BuildConfig.java file of the campusconnect.ucc component. This issue involves the use of a hard-coded cryptographic key. The attack is limited to local execution.

Name of the Vulnerable Software and Affected Versions GRID Organiser App versions up to 1.0.5 Description A security issue exists in GRID Organiser App up to version 1.0.5 on Android. The issue involves the use of a hard-coded cryptographic key due to manipulation of the `SegmentWriteKey` argument within the file res/raw/app.json of the component co.gridapp.organiser. Local access is required for exploitation. The exploit has been publicly disclosed. Recommendations Update GRID Organiser App to a version later than 1.0.5.

Name of the Vulnerable Software and Affected Versions Investory Toy Planet Trouble App versions up to 1.5.5 Description A security issue exists in Investory Toy Planet Trouble App on Android. The issue involves the manipulation of the `current key` argument, leading to the use of a hard-coded cryptographic key within the file assets/google-services-desktop.json of the component app.investory.toyfactory. The attack requires local access. The exploit is publicly available. Recommendations Update Investory Toy Planet Trouble App to a version newer than 1.5.5.

Name of the Vulnerable Software and Affected Versions Rico só vantagem pra investir App versions up to 4.58.32.12421 Description A security issue exists in Rico só vantagem pra investir App on Android, affecting the processing of the file `br/com/rico/mobile/di/SegmentSettingsModule.java` within the `br.com.rico.mobile` component. Manipulation of the `SEGMENT WRITE KEY` argument results in the use of a hard-coded cryptographic key. The attack can only be performed locally and the exploit has been publicly disclosed. The vendor was contacted but did not respond. Recommendations Update Rico só vantagem pra investir App to a version newer than 4.58.32.12421.

Name of the Vulnerable Software and Affected Versions Wahoo Fitness SYSTM App versions through 7.2.1 Description A security issue exists in the Wahoo Fitness SYSTM App on Android, up to version 7.2.1. The issue involves the use of a hard-coded cryptographic key within the file `com/WahooFitness/SYSTM/BuildConfig.java` of the `com.WahooFitness.SYSTM` component. Manipulation of the `SEGMENT WRITE KEY` argument can lead to the exposure of this key. Local access is required for exploitation. The exploit is publicly available. Recommendations Update to a version beyond 7.2.1 when available. As a temporary workaround, restrict local access to the application.

Name of the Vulnerable Software and Affected Versions Dialogue App versions up to 4.3.2 Description A security issue exists in Dialogue App for Android, specifically in the component ca.diagram.dialogue. A manipulation of the `SEGMENT WRITE KEY` argument within the file res/raw/config.json can lead to the use of a hard-coded cryptographic key. This issue is restricted to local execution. The exploit has been publicly disclosed, and the vendor was notified but did not respond. Recommendations Update Dialogue App to a version later than 4.3.2.

Name of the Vulnerable Software and Affected Versions Align Technology My Invisalign App version 3.12.4 Description A security issue exists in Align Technology My Invisalign App version 3.12.4 on Android. The issue involves the manipulation of the `CDAACCESS TOKEN` argument within an unknown function of the file `com/aligntech/myinvisalign/BuildConfig.java` of the component `com.aligntech.myinvisalign.emea`, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit is publicly available. Recommendations Update to a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions PropertyGuru AgentNet Singapore App versions through 23.7.10 Description A security flaw exists in PropertyGuru AgentNet Singapore App on Android up to version 23.7.10. The issue involves the manipulation of the arguments `SEGMENT ANDROID WRITE KEY` and `SEGMENT TOS WRITE KEY` within an unknown function of the file `com/allproperty/android/agentnet/BuildConfig.java` of the component `com.allproperty.android.agentnet`, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit has been publicly released. Recommendations Update PropertyGuru AgentNet Singapore App to a version later than 23.7.10.

Name of the Vulnerable Software and Affected Versions Noelse Individuals & Pro App versions through 2.1.7 Description A weakness exists in Noelse Individuals & Pro App on Android, up to version 2.1.7. The issue involves manipulation of the `SEGMENT WRITE KEY` argument within an unknown function of the file `com/reactnative/antelop/BuildConfig.java` of the `com.afone.noelse` component, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit has been publicly released. Recommendations Update Noelse Individuals & Pro App to a version later than 2.1.7.

Name of the Vulnerable Software and Affected Versions Shinrays Games Goods Triple App versions up to 1.200 Description A security flaw exists in Shinrays Games Goods Triple App up to version 1.200. The issue involves an unknown function within the jRwTX.java file of the cats.goods.sort.sorting.games component. Manipulation of the `AES IV`/`AES PASSWORD` argument leads to the use of a hard-coded cryptographic key. Local access is required for exploitation, which is considered difficult. The exploit has been publicly released. Recommendations Update to a version beyond 1.200.

An issue exists in the `ai.citydata.citychat` component within the file 'resources/assets/flutter assets/assets/credentials.json'. A manipulation of this file can lead to the unprotected storage of credentials. This attack requires local access and is characterized by high complexity, making exploitation difficult.

A security issue exists in BabyChakra Pregnancy & Parenting App on Android. Manipulation of the `SEGMENT WRITE KEY` argument within the file `app/babychakra/babychakra/Configuration.java` component can lead to the unprotected storage of credentials. The attack requires local access and is considered difficult to exploit. The exploit is publicly available. The vendor was notified but did not respond.

A security issue has been identified in XREAL Nebula App on Android. The issue affects an unknown function within the `ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java` file of the `ai.nreal.nebula.universal` component. Manipulation of the `accessKey`, `secretAccessKey`, and `securityToken` arguments can lead to unprotected storage of credentials. The attack is limited to local execution and is considered difficult to exploit, requiring a high level of complexity. The exploit has been publicly disclosed.

A weakness exists in La Nacion App version 10.2.25 on Android. The issue impacts an unknown function within the file `source/app/lanacion/clublanacion/BuildConfig.java` of the `app.lanacion.activity` component. Manipulation of the `API KEY WEBSOCKET CV` argument can result in the unprotected storage of credentials. The attack is limited to local execution and is considered difficult to exploit, despite the public availability of the exploit. The vendor was notified but did not respond.

A security issue exists in Albert Sağlık Hizmetleri ve Ticaret Albert Health on Android. The issue involves the unprotected storage of credentials due to a manipulation of the Google Cloud Service Account Key Handler component, specifically within the `resources/assets/service-account.json` file. The attack requires local access and is considered difficult to exploit. The exploit has been publicly disclosed. The vendor was notified but did not respond.

A weakness exists in the i-SENS SmartLog App on Android, affecting an unknown function within the `air.SmartLog.android` component. This issue results in the presence of hard-coded credentials. The attack is limited to local execution. The exploit is publicly available. The affected function is related to a developer mode used for Bluetooth pairing between a blood glucose meter and the SmartLog application, intended for device integration and testing.

A flaw exists in myAEDES App on Android that allows information disclosure. The issue is related to the manipulation of the `AUTH KEY` argument within an unknown function of the file `aedes/me/beta/utils/EngageBayUtils.java` of the `aedes.me.beta` component. This issue is only exploitable with local access and is considered difficult to exploit. The exploit is publicly available. The vendor was notified but did not respond.

A flaw exists in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App on Android. The issue affects an unknown functionality within the `com/index/event/BuildConfig.java` file of the `ae.index.apgcs` component. Manipulation of the `ACCESS KEY`/`HASH KEY` argument can lead to the disclosure of hard-coded credentials. Exploitation is limited to local execution. The exploit has been published. The vendor was contacted regarding this issue but did not respond.

A security flaw has been discovered in APEUni PTE Exam Practice App on Android. The issue involves improper export of android application components due to an unknown function within the `AndroidManifest.xml` file of the `com.ape edication` component. The attack requires a local approach. The exploit has been released publicly. The vendor was contacted regarding this disclosure but did not respond.

A vulnerability exists in SKTLab Mukbee App that results in improper export of android application components. The issue affects an unknown function within the `AndroidManifest.xml` file of the `com.dw.android.mukbee` component on Android devices. The attack requires local access. The exploit is publicly available. The vendor was notified but did not respond.