CVE-2019-13096

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

TronLink Wallet 2.2.0 stores user wallet keystore in plaintext and places them in insecure storage. An attacker can read and reuse the user keystore of a valid user via /data/data/com.tronlink.wallet/shared_prefs/<wallet-name>.xml to gain unauthorized access.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://pastebin.com/raw/08REmV1XExploit, Third Party Advisory
https://pastebin.com/raw/J9B8Lh0jExploit, Third Party Advisory
https://pastebin.com/raw/08REmV1XExploit, Third Party Advisory
https://pastebin.com/raw/J9B8Lh0jExploit, Third Party Advisory

Timeline

Published: Jul 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-130977.5The application API of Cat Runner Decorate Home version 2.8.0 for Android does not sufficiently verify inputs that are assumed to be immutab CVE-2019-130986.5The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. CVE-2019-130996.5The Momo application 2.1.9 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows a non-roo CVE-2019-13106.8A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a priv CVE-2019-131006.5The Send Anywhere application 9.4.18 for Android stores confidential information insecurely on the system (i.e., in cleartext), which allows CVE-2019-131019.8An issue was discovered on D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices. wan.htm can be accessed directly without authentication, whic CVE-2019-131037.1A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the sta CVE-2019-131047.8In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including CVE-2019-131057.8Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem.CVE-2019-131067.8Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack CVE-2019-131079.8Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c CVE-2019-131086.5An integer overflow in Exiv2 through 0.27.1 allows an attacker to cause a denial of service (SIGSEGV) via a crafted PNG image file, because