For Android
Monthly
The ゲオアプリ (GEO app) from GEO CORPORATION fails to properly authorize requests handled through its registered custom URL scheme, so an attacker who can get a victim to open a crafted link can redirect the app's in-app browser (WebView) to an arbitrary website, exposing the user to phishing content or leaking a service session ID. The flaw affects both the Android and iOS builds (CWE-939; CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning the attack is remote and unauthenticated but depends on victim interaction, with impact limited to low confidentiality and integrity loss and no availability effect. This is a medium-severity issue, not a top-tier priority, and no public exploit was identified at time of analysis.
The GEO app (ゲオアプリ) for Android and iOS stores user passwords in cleartext within its local storage, allowing an attacker with physical access to a device to read the credentials. This vulnerability (CWE-312) has a CVSS score of 4.3 (Medium) and requires physical possession of an unlocked device with the app installed and a saved password. No public exploit code is known at time of analysis, and no vendor patch has been identified.
The ゲオアプリ (GEO app) from GEO CORPORATION fails to properly authorize requests handled through its registered custom URL scheme, so an attacker who can get a victim to open a crafted link can redirect the app's in-app browser (WebView) to an arbitrary website, exposing the user to phishing content or leaking a service session ID. The flaw affects both the Android and iOS builds (CWE-939; CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), meaning the attack is remote and unauthenticated but depends on victim interaction, with impact limited to low confidentiality and integrity loss and no availability effect. This is a medium-severity issue, not a top-tier priority, and no public exploit was identified at time of analysis.
The GEO app (ゲオアプリ) for Android and iOS stores user passwords in cleartext within its local storage, allowing an attacker with physical access to a device to read the credentials. This vulnerability (CWE-312) has a CVSS score of 4.3 (Medium) and requires physical possession of an unlocked device with the app installed and a saved password. No public exploit code is known at time of analysis, and no vendor patch has been identified.