CVE-2025-32317

CVE-2025-32317 affects the Android App Widget, where a confused deputy leads to a local information disclosure without extra privileges or user interaction. The issue is categorized as Information Disclosure (CVE type) with a CVSSv3.1 base score of 5.5 (Medium) and a Local attack vector with Conf...

CVE-2025-26461

In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to close the app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction...

CVE-2025-57807

creationtimestamp| type| source ---|---|--- 2025-09-05 09:23:40+00:00| published-proof-of-concept| https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg 2025-09-05 23:36:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ly4tavtmx42t 2025-09-08...

"Yahoo! Shopping" App for Android fails to restrict custom URL schemes properly

Overview "Yahoo! Shopping" App for Android provided by LY Corporation contains the following vulnerability. Improper authorization in handler for custom URL scheme CWE-939 - CVE-2025-41408 Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...

CVE-2025-41408

Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attac...

CVE-2025-56139

LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata image, title, description when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different UR...

LY Yahoo! Shopping App 安全漏洞

LY Yahoo! Shopping App is a shopping mobile application from LY Japan. A security vulnerability exists in LY Yahoo! Shopping App versions prior to 14.15.0, which stems from improper handling of the custom URL scheme and could lead to users becoming victims of phishing attacks...

PT-2025-36237

Name of the Vulnerable Software and Affected Versions: Permission Manager affected versions not specified Description: In Permission Manager, the microphone privacy indicator may remain activated even after a user attempts to close the application. This is due to a logic error in the code and cou...

PT-2025-36110

Name of the Vulnerable Software and Affected Versions: Yahoo! Shopping App for Android versions prior to 14.15.0 Description: Improper authorization in the handler for a custom URL scheme in the Yahoo! Shopping App for Android may allow a remote, unauthenticated attacker to redirect a user to an...

PT-2025-36239

Name of the Vulnerable Software and Affected Versions: App Widget affected versions not specified Description: An information disclosure issue exists in App Widget due to a confused deputy condition. This could result in local information disclosure without requiring additional execution privileg...

CVE-2025-22431

In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in the code. This could lead to local denial of service until the phone reboots with no additional execution privileges needed. User...

CVE-2025-48551

creationtimestamp| type| source ---|---|--- 2025-09-04 21:54:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ly254ptptn2f...

CVE-2025-22415

In androidapp of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22415

In androidapp of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-23301

creationtimestamp| type| source ---|---|--- 2025-09-04 19:49:10+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lxzw3vuzlc2b...

CVE-2025-22415

In androidapp of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48559

In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48559

In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48558

In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2025-48558

In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...