com.heytap.browser

Schwachstellenbericht Übersicht: Eine Schwachstelle wurde in der Anwendung com.heytap.browser auf der Android-Plattform entdeckt. Die Schwachstelle ermöglicht es einem Angreifer, beliebigen JavsScript-Code im Kontext der Anwendung ohne Berechtigungen auszuführen. Anwendungsdetails: Anbieter: -...

Damn-Vulnerable-Android-Components

The Damne Vulnerable Android Components - DVAC Il setaccio rinato! Damn Vulnerable Android Components DVAC è un'applicazione Android educativa intenzionalmente progettata per esporre e dimostrare vulnerabilità relative a vari componenti Android come Activity, Intent, Content Provider e Broadcast...

CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component

CVE-2026-22010 – Reindirizzamento Android Intent verso Componente Esportato Codice del programma simulazione Java/Android root@kitploit: // VulnActivity.java - Exported activity that forwards intents public class VulnActivity extends Activity @Override protected void onCreateBundle b...

CVE-2023-41898_Lab

CVE-2023-41898 Unvalidated Deep Link Lab Dieses Lab ist eine pädagogische, verkleinerte Reproduktion, die auf dem öffentlichen Schwachstellenbericht GHSL-2023-142 für Home Assistant Companion for Android und der Open-Source-Struktur der verwundbaren Version 2023.8.2 basiert. Es werden keine echte...

CVE-2020-23349_Lab

CVE-2020-23349 Android Lab Progetto didattico per riprodurre localmente la vulnerabilità di Intent Redirection nell'SDK Android di Sina Weibo 4.2.7. Utilizzare solo su dispositivi di test autorizzati o emulatori. Non utilizzarlo contro app di utenti reali. Struttura victim: app vulnerabile che...

apk-interceptor

apk-interceptor Android-Bewertungshelfer für Deeplinks, Intents und WebView-Brücken apk-interceptor ist eine portable Android-Test-APK für autorisierte Anwendungssicherheitsbewertungen. Sie hilft Sicherheitsingenieuren zu überprüfen, wie eine Android-App externe Einstiegspunkte wie...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

EUVD-2026-54570

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47363

The CVE-2026-47363 describes a vulnerability in the Datadog Android app where the launcher activity AppActivity is exported with no permission guard and launchMode=singleTask. On every onCreate/onNewIntent, an extension (Intent.getUserSession()) deserializes a full UserSession (including user ide...

CVE-2026-44964

In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-47361

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

EUVD-2026-54567

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...

multi-layered-security-assessment

Advanced Network Attack and Defense: Multi-Layered Assessment...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...

CVE-2025-15464

The CVE-2025-15464 entry concerns yintibao Fun Print Mobile (Android, ARM64) with version 6.05.15 affected. The issue is an exported PandoraEntry activity that processes unvalidated external intents, enabling external applications to gain application context and directly launch Gmail with inbox a...

CVE-2025-15464 KL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context Hijacking

Exported Activity allows external applications to gain application context and directly launch Gmail with inbox access, bypassing security controls...