Bernhard Gründling

**Name of the Vulnerable Software and Affected Versions** Kiuwan Cloud (affected versions not specified) Kiuwan SAST on-premise (KOP) versions prior to 2.8.2509.4 **Description** Kiuwan SAST improperly authorizes SSO logins for mapped user accounts that have been locally disabled. This allows users whose accounts are disabled in the user admin settings to maintain access to the application. **Recommendations** Update Kiuwan SAST on-premise (KOP) to version 2.8.2509.4 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Kiuwan Cloud.

**Name of the Vulnerable Software and Affected Versions** Boomerang Parental Control application versions prior to 13.83 for Android **Description** An issue was discovered in the Boomerang Parental Control application where the app is missing the android:allowBackup="false" attribute in the manifest. This allows a user to backup the internal memory of the app to a PC, giving them access to the API token used to authenticate requests to the API. This vulnerability can be exploited by an attacker with physical access to the device, potentially allowing them to take over the admin control panel and spy on a kid. The estimated number of potentially affected devices is over 100,000. **Recommendations** For versions prior to 13.83, update to version 13.83 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. Additionally, users should be cautious when granting physical access to their devices to prevent potential attacks.

**Name of the Vulnerable Software and Affected Versions** Boomerang Parental Control versions through 13.83 for Android **Description** An issue was discovered in the Boomerang Parental Control application, allowing a child to use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing. **Recommendations** For versions through 13.83, consider disabling the Safe Mode feature temporarily until a patch is available to prevent the child from removing restrictions or uninstalling the application. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kiddoware Kids Place Parental Control version prior to 3.8.50 **Description** An issue in the Kiddoware Kids Place Parental Control application allows a child to temporarily remove all restrictions without the parents noticing. This can be achieved by rebooting into Android Safe Mode and disabling the "Display over other apps" permission. **Recommendations** For versions prior to 3.8.50, update to version 3.8.50 or later to resolve the issue.