Threats tagged 'ghsa-vp94-gjhf-w8x3'

The iRA 2.0 and iRA.ev mobile applications contain hardcoded service account credentials, API keys, and authorization tokens within their application packages. An unauthenticated remote attacker can extract these embedded sensitive details by downloading the application package. Exploiting this vulnerability could allow unauthorized access to backend services, potentially exposing sensitive information or enabling unauthorized operations.