Advisories · Technology
TPC Software Matchpoint.
Every CVE that names TPC Software Matchpoint among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
API keys, credentials, and configuration parameters embedded in the MatchPoint APK
- TPC Software Matchpoint
- CVSS 9.1 CriticalCritical · CVSS 9+
Incorrect validation of TLS certificates in the MatchPoint Android app
- TPC Software Matchpoint
- Weak cryptography or TLS
- CVSS 8.7 High
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
- TPC Software Matchpoint
- Authentication bypass
- CVSS 8.6 High
SQL injection in the push notification handler of the MatchPoint Android app
- TPC Software Matchpoint
- SQL injection
- CVSS 6.9 Medium
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences
- TPC Software Matchpoint
- CWE-256
- CVSS 9.9 CriticalCritical · CVSS 9+
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
- TPC Software Matchpoint
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform
- TPC Software Matchpoint