254 matches found
CVE-2023-38298
Various software builds for TCL 30Z, A3X, 20XE, and 10L devices are vulnerable to a privacy leak where the device IMEI is exposed via a system property. Due to a high-privilege process, the IMEI is leaked to the "gsm.device.imei0" property, which any local application can access without permissio...
CVE-2023-38297
A security vulnerability exists in the com.factory.mmigroup (version 2.1) component across several Android devices, including models from Samsung , T-Mobile , Boost Mobile , Realme , and Lenovo . Due to inadequate access control , a local third-party app can exploit this pre-installed app, which ...
CVE-2023-38298
Various software builds for the following TCL devices 30Z, A3X, 20XE, 10L leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device...
CVE-2023-38297
An issue was discovered in a third-party com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for various Android devices contain a vulnerable pre-installed app with a package name of com.factory.mmigroup versionCode='3', versionName='2.1...
PT-2024-12702 · Unknown · Com.Factory.Mmigroup
Name of the Vulnerable Software and Affected Versions: com.factory.mmigroup version 2.1 Description: An issue was discovered in the com.factory.mmigroup component, shipped on devices from multiple device manufacturers. Certain software builds for various Android devices contain a vulnerable...
CVE-2024-2566
A vulnerability was found in Fujian Kelixin Communication Command and Dispatch Platform up to 20240313. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file api/client/getextensionyl.php. The manipulation of the argument imei leads to sql...
Fujian Kelixin Command and Dispatch Platform SQL Injection Vulnerability
Fujian Kelixin Command and Dispatch Platform is a command and dispatch platform from Fujian Kelixin Company. A SQL injection vulnerability exists in Fujian Kelixin Command and Dispatch Platform version 20240313 and earlier versions, which stems from an incorrect operation of the parameter imei th...
PT-2024-21076 · Fujian Kelixin · Fujian Kelixin Communication Command/Dispatch Platform
Name of the Vulnerable Software and Affected Versions: Fujian Kelixin Communication Command and Dispatch Platform up to 20240313 Description: A critical issue affects an unknown functionality of the file api/client/get extension yl.php. The manipulation of the imei argument leads to SQL injection...
TheTruthSpy stalkerware, still insecure, still leaking data
In 2022, we published an article about how photographs of children taken by a stalkerware-type app were found exposed on the internet because of poor cybersecurity practices by the app vendor. The stalkerware-type app involved, TheTruthSpy, has shown once again that the way in which it handles...
CVE-2023-46723
lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use sendto.txt are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNSsuch as slack and zulip URL and API key. As of time of publication, a patch is not ye...
Code injection
lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use sendto.txt are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNSsuch as slack and zulip URL and API key. As of time of publication, a patch is not ye...
CVE-2023-46723 lte-pic32-writer's sendto.txt may disclose URL and the API key
lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use sendto.txt are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNSsuch as slack and zulip URL and API key. As of time of publication, a patch is not ye...
CVE-2023-46723 lte-pic32-writer's sendto.txt may disclose URL and the API key
lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use sendto.txt are vulnerable to attackers who known the IMEI reading the sendto.txt. The sendto.txt file can contain the SNSsuch as slack and zulip URL and API key. As of time of publication, a patch is not ye...
CVE-2023-46723
The CVE-2023-46723 issue affects lte-pic32-writer (versions 0.0.1 and earlier). The root cause is that the sendto.txt file can be read by anyone with knowledge of the IMEI, potentially exposing contained SNS URLs and API keys. Documented impact centers on confidentiality (exposure of keys/URLs); ...
SAMSUNG Mobile device 缓冲区错误漏洞
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile device SMR Jul-2023 Release 1 version, which stems from an incorrect input validation vulnerability ...
Authorization
Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call...
CVE-2022-39902
Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call...
CVE-2022-39902
The CVE-2022-39902 entry concerns Samsung Exynos baseband prior to SMR DEC-2022 Release 1, with improper authorization allowing a remote attacker to obtain sensitive data (including IMEI) via an emergency call. The vulnerability arises from insufficient access restrictions in the baseband compone...
