tronlink Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/tronlink/ Sun, 26 Feb 2023 06:30:07 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png tronlink Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/tronlink/ 32 32 CVE-2019-13096 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13096/ Sun, 26 Feb 2023 06:30:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13096/ TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/.xml to gain unauthorized access.

The post CVE-2019-13096 appeared first on CVE Vulnerability.

]]> TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/.xml to gain unauthorized access.

The post CVE-2019-13096 appeared first on CVE Vulnerability.

]]> CVE-2019-13098 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13098/ Sun, 26 Feb 2023 06:30:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13098/ The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data […]

The post CVE-2019-13098 appeared first on CVE Vulnerability.

]]> The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.

The post CVE-2019-13098 appeared first on CVE Vulnerability.

]]>