CVE-2019-12367

The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12366

The vulnerability CVE-2019-12366 affects the Nine Android app up to version 4.5.3a. The issue is an XSS via an event attribute and an arbitrary file loading via a src attribute when the app has READ_EXTERNAL_STORAGE permission. The Red Hat advisory reiterates this description. No concrete exploit...

CVE-2019-12366

The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12365

The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...

CVE-2019-12365

The CVE-2019-12365 entry affects the Newton Android app (version up to 10.0.23). It describes two issues: (1) XSS via an event attribute and (2) arbitrary file loading via a src attribute when the app holds READ_EXTERNAL_STORAGE permission. The related Red Hat/NVD entries confirm these descriptio...

CVE-2018-9140

On Samsung mobile devices with M6.0 software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747...

CVE-2018-9140

CVE-2018-9140 concerns Samsung mobile devices running Android M (6.0). The Email application is vulnerable to a cross-site scripting (XSS) attack via an event attribute and can load arbitrary files through a src attribute, identified as SVE-2017-10747. Connected sources (NVD/CNVD/PRION/CVELIST) c...

CVE-2018-9140

On Samsung mobile devices with M6.0 software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747...

PT-2011-10: Abritrary Files Loading in ManageEngine ServiceDesk Plus 8.0

The specialists of the Positive Research center have detected "Abritrary Files Loading" vulnerability in ManageEngine ServiceDesk Plus. Insufficient CSV file input filtering in user import script allows attackers with guest privileges account guest/guest overwrite an arbitrary file in bin folder ...