LiveHiddenCamera

隐形摄像头直播 隐形摄像头直播（Live Hidden Camera，简称 LHC）是一个可在不显示预览界面的情况下，录制 Android 设备实时视频和音频的库。 动机 我正在研究一款基于 Android 的恶意软件，并决定创建一款多功能 RAT（远程管理工具）。当时我正在研究直播流，发现了一些基于 RTMP 的开源项目，包括： https://github.com/begeekmyfriend/yasea https://github.com/ant-media/LiveVideoBroadcaster https://github.com/TakuSemba/RtmpPublish...

CVE-2024-25466

CVE-2024-25466 CVE-2024-25466 的描述 建议描述 React Native Document Picker 在 v.9.1.1 之前存在目录遍历漏洞，并在 v.9.1.1 中修复，允许本地攻击者通过精心设计的脚本对 Android 库组件执行任意代码。 漏洞类型 目录遍历 产品供应商 https://github.com/rnmods/react-native-document-picker/ 受影响产品代码库 react-native-document-picker android 库 - 适用于 Android 的...

ASB-A-513581389

In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-471796999

In screenArgsForPermissionCheckIfAny of MediaQueryForPreSelection.java, there is a possible way to access the images of other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

ASB-A-329233015

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

ASB-A-460778875

In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-522374659

In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-50091 Aqara Home Android SDK hardcoded keys

Aqara Home Android com.lumiunited.aqarahome 6.0.0 and white-label clients embedding the same liblumidevsdk.so uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 9.1...

CVE-2026-0023

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

cap-go/capacitor-native-biometric Authentication Bypass

There is a potential issue with the cap-go/capacitor-native-biometric library. --- Summary The cap-go/capacitor-native-biometric library was found to be subject to an authentication bypass as the current implementation of the onAuthenticationSucceeded does not appear to handle a...

CVE-2019-11932

A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of servi...

The vulnerability of the Android operating system library libimagecodec.quram.so in Samsung mobile devices allows a hacker to execute arbitrary code.

The vulnerability of the Android operating system’s libimagecodec.quram.so library in Samsung mobile devices is related to writing beyond the buffer boundaries of memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

EUVD-2014-4800

Malware in sbrugna...

EUVD-2014-5858

Malware in sbrugna...

EUVD-2012-5693

Malware in sbrugna...

EUVD-2014-6523

Malware in sbrugna...

EUVD-2014-5415

Malware in sbrugna...

EUVD-2014-5412

Malware in sbrugna...

CVE-2025-22425

In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2024-25466

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...