JVN#67586379: Reversi vulnerable to URL whitelist bypass

Reversi provided by Newphoria Corporation Inc. is an application for both iOS or Android built using “applican”. Reversi contains an issue where an arbitrary page may be loaded if the application is launched using the URL-scheme.

Impact

Android version of this app may allow an applican API to be executed if that API has been granted permission in the android manifest.
iOS version of this app may allow an arbitrary API to be executed.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• Reversi for Android versions 1.0.2 and earlier
• Reversi for iOS versions 1.1 and earlier