Fxizenta

**Name of the Vulnerable Software and Affected Versions** UCC CampusConnect App versions up to 14.3.5 **Description** A flaw exists in the UCC CampusConnect App for Android, specifically affecting the code within the campusconnect/BuildConfig.java file of the campusconnect.ucc component. This issue involves the use of a hard-coded cryptographic key. The attack is limited to local execution. **Recommendations** Update UCC CampusConnect App to a version newer than 14.3.5.

Name of the Vulnerable Software and Affected Versions GRID Organiser App versions up to 1.0.5 Description A security issue exists in GRID Organiser App up to version 1.0.5 on Android. The issue involves the use of a hard-coded cryptographic key due to manipulation of the `SegmentWriteKey` argument within the file res/raw/app.json of the component co.gridapp.organiser. Local access is required for exploitation. The exploit has been publicly disclosed. Recommendations Update GRID Organiser App to a version later than 1.0.5.

Name of the Vulnerable Software and Affected Versions Investory Toy Planet Trouble App versions up to 1.5.5 Description A security issue exists in Investory Toy Planet Trouble App on Android. The issue involves the manipulation of the `current key` argument, leading to the use of a hard-coded cryptographic key within the file assets/google-services-desktop.json of the component app.investory.toyfactory. The attack requires local access. The exploit is publicly available. Recommendations Update Investory Toy Planet Trouble App to a version newer than 1.5.5.

Name of the Vulnerable Software and Affected Versions Rico só vantagem pra investir App versions up to 4.58.32.12421 Description A security issue exists in Rico só vantagem pra investir App on Android, affecting the processing of the file `br/com/rico/mobile/di/SegmentSettingsModule.java` within the `br.com.rico.mobile` component. Manipulation of the `SEGMENT WRITE KEY` argument results in the use of a hard-coded cryptographic key. The attack can only be performed locally and the exploit has been publicly disclosed. The vendor was contacted but did not respond. Recommendations Update Rico só vantagem pra investir App to a version newer than 4.58.32.12421.

Name of the Vulnerable Software and Affected Versions Wahoo Fitness SYSTM App versions through 7.2.1 Description A security issue exists in the Wahoo Fitness SYSTM App on Android, up to version 7.2.1. The issue involves the use of a hard-coded cryptographic key within the file `com/WahooFitness/SYSTM/BuildConfig.java` of the `com.WahooFitness.SYSTM` component. Manipulation of the `SEGMENT WRITE KEY` argument can lead to the exposure of this key. Local access is required for exploitation. The exploit is publicly available. Recommendations Update to a version beyond 7.2.1 when available. As a temporary workaround, restrict local access to the application.

Name of the Vulnerable Software and Affected Versions Dialogue App versions up to 4.3.2 Description A security issue exists in Dialogue App for Android, specifically in the component ca.diagram.dialogue. A manipulation of the `SEGMENT WRITE KEY` argument within the file res/raw/config.json can lead to the use of a hard-coded cryptographic key. This issue is restricted to local execution. The exploit has been publicly disclosed, and the vendor was notified but did not respond. Recommendations Update Dialogue App to a version later than 4.3.2.

Name of the Vulnerable Software and Affected Versions Align Technology My Invisalign App version 3.12.4 Description A security issue exists in Align Technology My Invisalign App version 3.12.4 on Android. The issue involves the manipulation of the `CDAACCESS TOKEN` argument within an unknown function of the file `com/aligntech/myinvisalign/BuildConfig.java` of the component `com.aligntech.myinvisalign.emea`, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit is publicly available. Recommendations Update to a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions PropertyGuru AgentNet Singapore App versions through 23.7.10 Description A security flaw exists in PropertyGuru AgentNet Singapore App on Android up to version 23.7.10. The issue involves the manipulation of the arguments `SEGMENT ANDROID WRITE KEY` and `SEGMENT TOS WRITE KEY` within an unknown function of the file `com/allproperty/android/agentnet/BuildConfig.java` of the component `com.allproperty.android.agentnet`, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit has been publicly released. Recommendations Update PropertyGuru AgentNet Singapore App to a version later than 23.7.10.

Name of the Vulnerable Software and Affected Versions Noelse Individuals & Pro App versions through 2.1.7 Description A weakness exists in Noelse Individuals & Pro App on Android, up to version 2.1.7. The issue involves manipulation of the `SEGMENT WRITE KEY` argument within an unknown function of the file `com/reactnative/antelop/BuildConfig.java` of the `com.afone.noelse` component, leading to the use of a hard-coded cryptographic key. The attack requires local access. The exploit has been publicly released. Recommendations Update Noelse Individuals & Pro App to a version later than 2.1.7.

Name of the Vulnerable Software and Affected Versions Shinrays Games Goods Triple App versions up to 1.200 Description A security flaw exists in Shinrays Games Goods Triple App up to version 1.200. The issue involves an unknown function within the jRwTX.java file of the cats.goods.sort.sorting.games component. Manipulation of the `AES IV`/`AES PASSWORD` argument leads to the use of a hard-coded cryptographic key. Local access is required for exploitation, which is considered difficult. The exploit has been publicly released. Recommendations Update to a version beyond 1.200.

**Name of the Vulnerable Software and Affected Versions** CityData CityChat versions prior to 0.12.7 **Description** An issue exists in the `ai.citydata.citychat` component within the file 'resources/assets/flutter assets/assets/credentials.json'. A manipulation of this file can lead to the unprotected storage of credentials. This attack requires local access and is characterized by high complexity, making exploitation difficult. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** BabyChakra Pregnancy & Parenting App versions up to 5.4.3.0 **Description** A security issue exists in BabyChakra Pregnancy & Parenting App on Android. Manipulation of the `SEGMENT WRITE KEY` argument within the file `app/babychakra/babychakra/Configuration.java` component can lead to the unprotected storage of credentials. The attack requires local access and is considered difficult to exploit. The exploit is publicly available. The vendor was notified but did not respond. **Recommendations** Versions prior to 5.4.3.0 should be updated.

**Name of the Vulnerable Software and Affected Versions** XREAL Nebula App versions through 3.2.1 **Description** A security issue has been identified in XREAL Nebula App on Android. The issue affects an unknown function within the `ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java` file of the `ai.nreal.nebula.universal` component. Manipulation of the `accessKey`, `secretAccessKey`, and `securityToken` arguments can lead to unprotected storage of credentials. The attack is limited to local execution and is considered difficult to exploit, requiring a high level of complexity. The exploit has been publicly disclosed. **Recommendations** Versions through 3.2.1 should be updated when a fix becomes available. As a temporary workaround, consider restricting access to the `CloudStoragePlugin.java` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** La Nacion App version 10.2.25 **Description** A weakness exists in La Nacion App version 10.2.25 on Android. The issue impacts an unknown function within the file `source/app/lanacion/clublanacion/BuildConfig.java` of the `app.lanacion.activity` component. Manipulation of the `API KEY WEBSOCKET CV` argument can result in the unprotected storage of credentials. The attack is limited to local execution and is considered difficult to exploit, despite the public availability of the exploit. The vendor was notified but did not respond. **Recommendations** Update to a newer version of La Nacion App that addresses this issue. As a temporary workaround, restrict or disable the use of the `API KEY WEBSOCKET CV` argument until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Albert Sağlık Hizmetleri ve Ticaret Albert Health versions up to 1.7.3 **Description** A security issue exists in Albert Sağlık Hizmetleri ve Ticaret Albert Health on Android. The issue involves the unprotected storage of credentials due to a manipulation of the Google Cloud Service Account Key Handler component, specifically within the `resources/assets/service-account.json` file. The attack requires local access and is considered difficult to exploit. The exploit has been publicly disclosed. The vendor was notified but did not respond. **Recommendations** Versions prior to 1.7.3 should be updated.

**Name of the Vulnerable Software and Affected Versions** i-SENS SmartLog App versions up to 2.6.8 **Description** A weakness exists in the i-SENS SmartLog App on Android, affecting an unknown function within the `air.SmartLog.android` component. This issue results in the presence of hard-coded credentials. The attack is limited to local execution. The exploit is publicly available. The affected function is related to a developer mode used for Bluetooth pairing between a blood glucose meter and the SmartLog application, intended for device integration and testing. **Recommendations** Versions up to 2.6.8 should be updated when a future application update is released that either removes the developer mode function or restricts access to it.

**Name of the Vulnerable Software and Affected Versions** myAEDES App versions through 1.18.4 **Description** A flaw exists in myAEDES App on Android that allows information disclosure. The issue is related to the manipulation of the `AUTH KEY` argument within an unknown function of the file `aedes/me/beta/utils/EngageBayUtils.java` of the `aedes.me.beta` component. This issue is only exploitable with local access and is considered difficult to exploit. The exploit is publicly available. The vendor was notified but did not respond. **Recommendations** Versions through 1.18.4 should be updated when a fix is available. As a temporary workaround, consider restricting access to the `aedes.me.beta` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App versions up to 1.0.2 **Description** A flaw exists in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App on Android. The issue affects an unknown functionality within the `com/index/event/BuildConfig.java` file of the `ae.index.apgcs` component. Manipulation of the `ACCESS KEY`/`HASH KEY` argument can lead to the disclosure of hard-coded credentials. Exploitation is limited to local execution. The exploit has been published. The vendor was contacted regarding this issue but did not respond. **Recommendations** Versions prior to 1.0.2 should be updated. As a temporary workaround, consider restricting access to the `BuildConfig.java` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** APEUni PTE Exam Practice App versions up to 10.8.0 **Description** A security flaw has been discovered in APEUni PTE Exam Practice App on Android. The issue involves improper export of android application components due to an unknown function within the `AndroidManifest.xml` file of the `com.ape edication` component. The attack requires a local approach. The exploit has been released publicly. The vendor was contacted regarding this disclosure but did not respond. **Recommendations** Update APEUni PTE Exam Practice App to a version newer than 10.8.0.

**Name of the Vulnerable Software and Affected Versions** SKTLab Mukbee App version 1.01.196 **Description** A vulnerability exists in SKTLab Mukbee App that results in improper export of android application components. The issue affects an unknown function within the `AndroidManifest.xml` file of the `com.dw.android.mukbee` component on Android devices. The attack requires local access. The exploit is publicly available. The vendor was notified but did not respond. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.