CVE-2022-42979

Affected software: Ryde application, version 5.8.43, on Android and iOS. The root cause is insecure hostname validation, leading to information disclosure that can allow account takeover via a deep link. Public sources (NVD/Red Hat) confirm the issue and impact as high (C/H/I/A). The provided doc...

CVE-2022-31469

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...

CVE-2022-31469

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...

Cross site scripting

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...

CVE-2022-31469

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...

CVE-2022-31469

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /!!&app=%2e./ URI...

Open-Xchange OX App Suite 跨站脚本漏洞

Open-Xchange OX App Suite is an email and productivity suite client software from Open-Xchange Germany. A security vulnerability exists in Open-Xchange OX App Suite 7.10.6 and prior versions, which stems from a detection mechanism for deep links in emails that allows the injection of references t...

Lemon8 App fails to restrict access permissions

Overview Lemon8 by ByteDance K.K. provides the function to access a requested URL using Custom URL Scheme/DeepLink. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Ryo Sato of BroadBand Security,Inc. reported this...

Nextcloud: CSRF vulnerability in Nextcloud Desktop Client 3.6.1 on Windows when clicking malicious link

Summary It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link. e.g. in an email, chat link, etc This vulnerability was introduced in an attempt to fix 1720043. The patch however can be bypassed and also introduced a CSRF vulnerability...

TikTok Users Were Vulnerable to a Single-Click Attack

Microsoft disclosed the flaw in the Android app’s deep link verification process, which has since been fixed...

CVE-2022-23101

OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...

CVE-2022-23101

OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...

CVE-2022-23101

OX App Suite through 7.10.6 allows XSS via appHandler in a deep link in an e-mail message...

CVE-2022-23101

The CVE-2022-23101 issue affects Open-Xchange OX App Suite up to version 7.10.6, with a cross-site scripting (XSS) flaw exploitable via the appHandler in a deep link contained in an e‑mail. Root cause described across connected documents is improper handling of deep links by appHandler, enabling ...

CVE-2022-28799

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...

Bytedance TikTok 安全漏洞

Bytedance TikTok Jieyin International Version is an application for creating and sharing short videos by Chinese company Bytedance. A security vulnerability exists in TikTok versions prior to 23.8.4, which stems from a crafted URL unauthenticated deep link that can force com.zhiliaoapp.musically...

Basecamp: Able to steal bearer token from deep link

Pre-requisities Prior to exploitation you would be required to know the "account id" of the user that you are attacking. Whilst this makes it difficult to attack an application in a generic way - the account is not secret information as it is included in any links to a user's basecamp organisatio...

Flickr: Incorrect Deep-link validation leading to unresponsive application and device

A specifically crafted URL provided to a victim caused their Flickr for Android app to become unresponsive...

Samsung Internet Input Validation Error Vulnerability

Samsung Internet is a cell phone application from Samsung South Korea. It provides a browser function. A security vulnerability exists in Samsung Internet prior to version 13.2.1.46, which can be exploited by an attacker to launch unexported activities in Samsung Browser via a malicious deeplink...

Shopify: Improper deep link validation

The application contains an activity which validates and handles the deep link requests, initiated from a VIEW intent action. The declared schemes include http and https request for the domain shopify.com as well as .myshopify.com. The path prefixes include mostly subdirectories of the /admin pat...