151 matches found
CVE-2024-45240
The TikTok aka com.zhiliaoapp.musically application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal in the application's exposed WebView. On Android 12 and later, this is only exploitable by third-party applications...
PT-2024-31498 · Bytedance · Tiktok
Name of the Vulnerable Software and Affected Versions: TikTok versions prior to 34.5.5 Description: The issue allows the takeover of Lynxview JavaScript interfaces via deeplink traversal in the application's exposed WebView. On Android 12 and later, this is only exploitable by third-party...
(Pwn2Own) Samsung Galaxy S23 Galaxy Store Deeplink Permissive List of Allowed Inputs Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S23 smartphones. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Basecamp: Path traversal in deeplink query parameter can expose any user's private info to a public directory (one click)
The Basecamp mobile application was found to be vulnerable to a path traversal issue. By crafting a malicious deeplink with a specific "filename" parameter, an attacker could force the application to save user data to any directory on the device, including locations accessible to other applicatio...
CVE-2024-3872
Mattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial complexity to parse certain deeplinks, which allows an unauthenticated remote attacker to freeze or crash the app via a long maliciously crafted link...
TikTok: Lynxview JS interfaces Takeover via deeplink traversal
The application had vulnerabilities that could have allowed the takeover of JavaScript interfaces via the application's exposed Webview. The issues were only present in older versions of the Android application and were addressed after the researcher reported them to the team...
CVE-2024-20829
Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an application without proper interaction...
CVE-2024-20829
Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an application without proper interaction...
Design/Logic Flaw
Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an application without proper interaction...
CVE-2024-20829
Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an application without proper interaction...
CVE-2024-20829
The CVE-2024-20829 issue affects Samsung Internet (pre-24.0.0.0) where missing proper interaction for opening deeplinks can allow a remote attacker to open an application without user interaction. Connected sources (PT-2024-18736) specify Samsung Internet versions prior to 24.0.0.0 as affected an...
CVE-2024-20829
Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an application without proper interaction...
CVE-2023-7114
Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server...
CVE-2023-7114
Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server...
Cross site request forgery (csrf)
Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server...
CVE-2023-7114
Mattermost 2.10.0 and earlier is affected by a CSRF vulnerability caused by failure to sanitize deeplink paths in the server. The issue affects the way deeplink paths are handled, enabling cross-site request forgery attacks against Mattermost servers. The connected documents consistently identify...
CVE-2023-7114
Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server...
PT-2023-32883 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 2.10.0 and earlier Description: The issue allows an attacker to perform CSRF attacks against the server due to the failure to sanitize deeplink paths. Recommendations: For Mattermost versions 2.10.0 and earlier, update to ...