Llorenç RomàPosts tagged
7posts
A client-controlled user_id in MobiAPParc’s password recovery flow allowed arbitrary password resets. Predictable IDs, email enumeration, and missing rate limiting increased the impact.
Read the articleA session cookie rejected by the token refresh endpoint continued to be accepted by a GraphQL mutation endpoint for 20 minutes after password reset — here's how I found it, proved it, and reported it.
Read the articleA pre-registration flaw in DroneAware Node allowed silent account takeover — any user authenticating via Google SSO or email verification could have their account hijacked.
Read the articleA travel app sold device-limited content packages protected by PDF passwords and GPS track encryption. On a rooted Android device, both the password and the tracks were sitting in cleartext in a SQLite database.
Read the articleA static SAML nonce in u5CMS allowed any authenticated user to forge sessions as an administrator, leading to RCE. Two additional XSS and open redirect issues were patched in the same release.
Read the articlePassword-protected MapShares had unauthenticated API endpoints allowing location requests and inReach messaging — plus guessable identifiers exposing public maps.
Read the articleA privacy issue in Garmin inReach allowed enumeration of map URLs due to short, guessable identifiers — exposing messages, locations, and contact details.
Read the article