CVE Intelligence

Vulnerabilidades de NewType Infortech

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de NewType Infortech: 5 registro(s), com severidade, exploração e correções.

NT OneAPP 5

Somente exploradas (KEV) →

CVE-2026-114223 Média · 5.5 CWE-312 22/10/2026
NewType Infortech｜NT OneAPP - Exposure of Sensitive Information
NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.
CVE-2026-114222 Média · 6.2 CWE-287 22/10/2026
NewType Infortech｜NT OneAPP - Authentication Bypass
NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user.
CVE-2026-114221 Alta · 7.4 CWE-522 22/10/2026
NewType Infortech｜NT OneAPP - Credential Disclosure
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
CVE-2026-114220 Crítica · 9.1 CWE-295 22/10/2026
NewType Infortech｜NT OneAPP - Improper Certificate Validation
NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.
CVE-2026-114219 Alta · 7.4 CWE-798 22/10/2026
NewType Infortech｜NT OneAPP - Hard-coded Credentials
NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.