bug-bounty622
facebook466
xss316
google157
microsoft104
rce102
apple62
csrf60
web355
account-takeover53
writeup51
exploit43
sqli41
dos34
ssrf34
cve33
cloudflare32
privilege-escalation29
defi28
malware26
smart-contract-vulnerability25
idor25
node25
subdomain-takeover24
clickjacking23
smart-contract23
ethereum23
access-control21
vulnerability-disclosure21
auth-bypass19
reverse-engineering19
react19
remote-code-execution18
aws18
lfi18
cloud17
cors17
info-disclosure16
oauth16
race-condition16
supply-chain15
docker14
authentication-bypass14
solidity14
browser13
phishing13
denial-of-service11
sql-injection11
delegatecall11
wordpress10
0
vulnerability
DuoLingo's TinyCards Android app was vulnerable to content injection attacks due to loading initial web content over unencrypted HTTP instead of HTTPS, allowing MITM attackers to inject arbitrary JavaScript and achieve code execution within the WebView. The vulnerability was fixed in version 1.0 (version code 10) released November 20, 2017.
content-injection
remote-code-execution
android
webview
man-in-the-middle
ssl-bypass
javascript-injection
insecure-transport
mobile-security
http-downgrade
CVE-2017-16905
DuoLingo
TinyCards
Google Play Security Reward Program
Nightwatch Cybersecurity
Yakov Shafranovich