TPC Software vulnerabilities
Every vulnerability this feed holds for TPC Software, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
7 vulnerabilities tracked.
- 9.9 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying…
- 9.9 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform.
- 9.1 Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive…
- 8.7 Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using…
- 8.6 SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and…
- 6.9 Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences.
- 5.1 API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering.
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that TPC Software is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Red Hat Google Linux Microsoft Apple Apache Software Foundation zephyrproject n/a Oracle Corporation Unknown Hewlett Packard Enterprise (HPE) Eclipse Foundation Tanium FreeRDP IBM Dell Samsung Semiconductor SuiteCRM MONGODB kyverno vercel vim Hitachi jpadilla