CVE-2021-32612

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. This includes logins, registrations, and password change requests. This allows information theft and account takeover via network sniffing.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2021/Jun/45Exploit, Mailing List, Third Party Advisory
https://play.google.com/store/apps/details?id=com.veryfit2hr.second&hl=en_US&gl=USProduct
https://trovent.github.io/security-advisories/TRSA-2105-01/TRSA-2105-01.txtExploit, Third Party Advisory
https://trovent.io/security-advisory-2105-01Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Jun/45Exploit, Mailing List, Third Party Advisory
https://play.google.com/store/apps/details?id=com.veryfit2hr.second&hl=en_US&gl=USProduct
https://trovent.github.io/security-advisories/TRSA-2105-01/TRSA-2105-01.txtExploit, Third Party Advisory
https://trovent.io/security-advisory-2105-01Exploit, Third Party Advisory

Timeline

Published: Jun 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-326135.5In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS.CVE-2021-326147.1A flaw was found in dmg2img through 20170502. fill_mishblk() does not check the length of the read buffer, and copy 0xCC bytes from it. The CVE-2021-326159.8Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.CVE-2021-326166.11CDN is open-source file sharing software. In 1CDN before commit f88a2730fa50fc2c2aeab09011f6f142fd90ec25, there is a basic cross-site scrip CVE-2021-326175.5Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An inefficient al CVE-2021-326186.1The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintai CVE-2021-326199.8Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, modules that are dynami CVE-2021-32629.8TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body paramet CVE-2021-326208.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 11.10.13, 12.6 CVE-2021-326218.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.CVE-2021-326227.8Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file,CVE-2021-326236.5Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable t