Tomonori Shiomi

The issue allows for a man-in-the-middle (MITM) attack due to the application's acceptance of non-SSL/TLS communications. This enables an attacker to invoke any API from a script injected during the attack.

The issue allows for a man-in-the-middle (MITM) attack because the application permits non-SSL/TLS communications. This enables an attacker to invoke any API from a script injected during the attack.

The Android apps do not properly implement the WebView class, allowing an attacker to disclose information stored on the device via a specially crafted application.

The issue allows an attacker to execute unintended operations via a specially crafted application.

The issue concerns the failure to verify SSL certificates, which could lead to security risks.

The issue allows man-in-the-middle attackers to obtain API access via unspecified vectors.

A cross-site scripting (XSS) issue exists in the runtime engine, allowing remote attackers to inject arbitrary web script or HTML via a crafted SSID encountered by an applican application.

A cross-site scripting (XSS) issue exists in the runtime engine of the Newphoria applican framework, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This is achieved by triggering WebView anchor attachment in an applican application.

The issue allows attackers to bypass a URL whitelist protection mechanism and obtain API access.

The issue allows attackers to bypass a URL whitelist protection mechanism and obtain API access.

The issue allows attackers to bypass the whitelist.xml URL whitelist protection mechanism, obtaining API access.

The issue allows attackers to bypass a URL whitelist protection mechanism and obtain API access.

The issue allows attackers to bypass a URL whitelist protection mechanism and obtain API access.

The issue allows attackers to bypass a URL whitelist protection mechanism and obtain API access.

The issue is related to a cross-site scripting (XSS) vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This is achieved via a crafted SSID.

The issue allows attackers to bypass a URL whitelist protection mechanism and obtain API access.