CVE-2021-1039

In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2021-1017

In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

CVE-2021-1017

Consolidated findings for CVE-2021-1017 (Android 12): The issue arises from a missing permission check in AdapterService and GattService definitions in AndroidManifest.xml, enabling local privilege escalation by disabling Bluetooth connectivity. Affected component(s): Android’s Bluetooth framewor...

Google Android 安全漏洞

An elevation of privilege vulnerability exists in Google Android, a Linux-based open source operating system from Google, Inc. The vulnerability stems from a lack of privilege checking in the broadcast definition of AndroidManifest.xml, which could potentially set the A2DP Bluetooth device...

CVE-2021-33699

Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Task Control features. This allows an unauthorized attacker or malware to takeover legitimate apps and to steal user's sensitive information...

Zivver: ADB Backup is enabled within AndroidManifest

In this report, it was highlighted that the ADB backup feature enabled in the Android application could be used by an attacker with physical access to the victim's device to 'migrate' data from app storage on the phone and later possibly extract secrets from that backup. For this attack to succee...

CVE-2020-0481

In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a non-system app to send a broadcast it shouldn't have permissions to send, with no additional execution privileges needed. User interaction is not needed for...

CVE-2020-0481

This CVE (CVE-2020-0481) concerns Android where in AndroidManifest.xml a permissions bypass enables local elevation of privilege. The impact is that a non-system app could broadcast without having required permissions, with no user interaction. Affected info from the sources specifies Android 11 ...

Design/Logic Flaw

In the permission declaration for com.google.android.providers.gsf.permission.WRITEGSERVICES in AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

Shipt: Vulnerabilities in exported activity WebView

Hello, i want to report the vulnerability found, Since the following activity com.pushio.manager.iam.ui.PushIOMessageViewActivity has exported=true it can be exploited by 3rd parties. Vulnerability com.pushio.manager.iam.ui.PushIOMessageViewActivity has exported set to true making the activity...

JetBrains IntelliJ IDEA XML parser XML External Entity Injection Vulnerability

JetBrains IntelliJ IDEA is the Czech Republic JetBrains set of integrated development environment for the Java language . XML parser is one of the XML parser . An XML external entity injection vulnerability exists in the XML parser in JetBrains IntelliJ IDEA, which can be exploited to retrieve...

ReverseAPK - Quickly Analyze And Reverse Engineer Android Packages

Quickly analyze and reverse engineer Android applications. FEATURES: Displays all extracted files for easy reference Automatically decompile APK files to Java and Smali format Analyze AndroidManifest.xml for common vulnerabilities and behavior Static source code analysis for common vulnerabilitie...

Pwn2Own Huawei HiApp vulnerability principle and the use of analysis on-vulnerability warning-the black bar safety net

0×01 description ps:this article from the attacker's perspective to analyze how to find the Pwn2Own Huawei mobile phone vulnerabilities, but does not represent the vulnerabilities discoverer of the idea is the same, for informational purposes only. This series vulnerability analysis as it involve...

CVE-2017-8315

CVE-2017-8315 affects the Eclipse IDE’s XML parser used in Eclipse IDE versions 2017.2.5 and earlier. The vulnerability is an XML External Entity (XXE) issue where an attacker can exploit the parser by introducing malicious code in the AndroidManifest.xml, potentially compromising confidentiality...

CVE-2017-8315

Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on Androidmanifest.xml...

CVE-2017-8315

Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the vulnerability by implementing malicious code on Androidmanifest.xml...

CVE-2016-10137

An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the...

Simple App to-end security vulnerability of any debugging vulnerabilities, the middleman hijacking vulnerability and the encryption algorithm vulnerability-vulnerability warning-the black bar safety net

Last week to introduce to the APP-end backup feature is turned on vulnerability and local denial of service vulnerability this week to introduce the completion of the last of the three common App-side vulnerabilities: arbitrary debugging vulnerabilities, MiTM hijacking vulnerability and the...