← All credits

Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.

12 vulnerability records and advisories credit this contributor.

iTrack Easy's getgps data can be modified without authentication

iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request

Zizai Tech Nut stores the account password in cleartext

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data

iTrack Easy mobile application stores the user password in base-64 encoding/cleartext

TrackR Bravo mobile application stores account passwords in cleartext

TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users

TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID

TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes

Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token