22 matches found
CVE-2026-54318 Home Assistant: Exported BroadcastReceiver allows local apps to spoof device location
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services...
CVE-2026-54318: Improper Export of Android Application Components
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services...
EUVD-2025-203405
The Cordova plugin cordova-plugin-x-socialsharing SocialSharing-PhoneGap-Plugin for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plugins.ShareChooserPendingIntent with an android.intent.action.SEND intent filter. The onReceive implementation accesses...
EUVD-2023-25260
Malicious code in bioql PyPI...
CVE-2025-21038
Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerary information...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
Input validation
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2023-21092
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
ASB-A-242040055
In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of System App due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction ...
CVE-2022-39861
Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege...
VK.com: [Клевер/Android] Небезопасный BroadcastReceiver позволяет создавать окно диалога в приложении посредством другого неавторизованного приложения
Небезопасный BroadcastReceiver. morethEnvulnerability Click to view screenshot Когда приложение видно пользователю в MainActivity регистрируются два ресивера: java registerReceiverthis.r, new IntentFilter"com.vk.quiz.action"; registerReceiverthis.q, new IntentFilter"com.vk.quiz.action.coins";...
Information modification vulnerability in multiple Samsung Galaxy devices
The Samsung Galaxy S4 and others are smart mobile devices released by the South Korean company Samsung Samsung. The information modification vulnerability exists in Samsung Galaxy S4 to S7 devices and stems from the program's failure to validate BroadcastReceiver responses. An attacker could...
CVE-2016-7988
On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.Samsung.android.intent.action.SETWIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of...
Code injection
On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.Samsung.android.intent.action.SETWIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of...
CVE-2016-7988
On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.Samsung.android.intent.action.SETWIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of...
PT-2016-7456
Name of the Vulnerable Software and Affected Versions Samsung Galaxy S devices versions S4 through S7 Description The issue arises from the absence of permissions on the BroadcastReceiver responsible for handling the "com.Samsung.android.intent.action.SET WIFI" intent. This leads to unsolicited...
CVE-2016-7988: Undefined Security Weakness
On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.Samsung.android.intent.action.SETWIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of...