CVE-2023-36620

An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in the manifest. This allows the user to backup the internal memory of the app to a PC. This gives the user access to the API token that is used to authenticate requests to the API.

• CWE-284

• https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/Third Party Advisory
• https://seclists.org/fulldisclosure/2023/Jul/12Exploit, Mailing List, Third Party Advisory
• https://useboomerang.com/Product
• https://sec-consult.com/blog/detail/the-hidden-costs-of-parental-control-apps/Third Party Advisory
• https://seclists.org/fulldisclosure/2023/Jul/12Exploit, Mailing List, Third Party Advisory
• https://useboomerang.com/Product

Published

Nov 3, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36611 The affected TBox RTUs allow low privilege users to access …6.5
• CVE-2023-36612Directory traversal can occur in the Basecamp com.basecamp.b…7.5
• CVE-2023-36617A ReDoS issue was discovered in the URI component before 0.1…5.3
• CVE-2023-36618Atos Unify OpenScape Session Border Controller through V10 R…8.8
• CVE-2023-36619Atos Unify OpenScape Session Border Controller through V10 R…9.8
• CVE-2023-3662In CODESYS Development System versions from 3.5.17.0 and pri…7.3
• CVE-2023-36621An issue was discovered in the Boomerang Parental Control ap…9.1
• CVE-2023-36622The websocket configuration endpoint of the Loxone Miniserve…7.2
• CVE-2023-36623The root password of the Loxone Miniserver Go Gen.2 before 1…7.8
• CVE-2023-36624Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authe…7.8
• CVE-2023-36627A flaw exists in FlashBlade Purity whereby a user with acces…2.7
• CVE-2023-36628A flaw exists in VASA which allows users with access to a vS…8.8