RSS   Vulnerabilities for 'Timelybills'   RSS

2021-04-06
 
CVE-2021-26833

CWE-312
 

 
Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows attacker who can locally read user's files obtain JWT tokens for user's account due to insufficient cache clearing mechanisms. A threat actor can obtain sensitive user data by decoding the tokens as JWT is signed and encoded, not encrypted.

 


Copyright 2021, cxsecurity.com

 

Back to Top