On this page you will find all the information about the vulnerabilities we have analysed and fixed in relation to our connected products and services.
Please contact us using the button below if you find a vulnerability that is not listed in the tables below. For more information about our cybersecurity, privacy and data protection policies, please visit this page.
On this page you will find all the information about the vulnerabilities we have analysed and fixed in relation to our connected products and services.
Please contact us using the button below if you find a vulnerability that is not...
| Name | CWE control | CVSS 4.0 | Affected version | Description |
|---|---|---|---|---|
| User enumeration | CWE-204 | 6.9 | < v2024-09 | User enumeration in the password reset module in MeetMe Web API version < v2024-09 allows an attacker to determine if an email address is registered through specific error messages. |
| Lack of protection against automation | CWE 307 | 5.3 | < v2024-09 | Unauthorized access in the MeetMe Signaling extension system in versions prior to v2024-09 allows an attacker to identify multiple users and perform brute force attacks through extensions. |
| Improper credential management | CWE 522 | 8.5 | ||
| < v2024-09 | Credential exposure in the configuration module of MeetMe Signaling in versions prior to v2024-09 allows an attacker to access some important assets through configuration files. | |||
| Name | CWE control | CVSS 4.0 | Affected version | Description |
|---|---|---|---|---|
| Android application vulnerable to Janus | CWE 295 | 7.8 | < 3.4.0 | Insecure signature in DuoxMe (previously “Blue”) app signing system in versions prior to 3.4.0 for Android 5.0 to 7.0 devices allows an attacker to modify the application code without affecting its signature through the Janus vulnerability. |
| Absence of protection mechanisms | CWE 312 | 6.9 | < 3.3.1 | Lack of encryption in the DuoxMe (previously “Blue”) app binary in versions prior to 3.3.1 for iOS devices allows an attacker to gain unauthorized access to the application code and discover sensitive information. |