CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-26975

CVE-2020-26975 concerns Mozilla Firefox for Android. A malicious app that broadcasts an Intent to Firefox for Android could specify arbitrary headers, enabling attacks such as ambient authority abuse or session fixation. The issue is limited to Firefox for Android; other OSes are unaffected, and ...

CVE-2020-26975

When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. Note: This...

CVE-2020-35173

The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server aka services.ftpservice.FTPReceiver.ACTIONSTARTFTPSERVER and services.ftpservice.FTPReceiver.ACTIONSTOPFTPSERVER...

CVE-2020-35173

The Amaze File Manager Android app is affected by CVE-2020-35173 (before 3.4.2). The root cause is improper restriction of intents for controlling the FTP server (FTPReceiver.ACTION_START_FTPSERVER and ACTION_STOP_FTPSERVER). This could allow unauthorized control of the FTP service; CVSS scores i...

CVE-2020-35173

The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server aka services.ftpservice.FTPReceiver.ACTIONSTARTFTPSERVER and services.ftpservice.FTPReceiver.ACTIONSTOPFTPSERVER...

Teamamaze Amazefilemanager Security Vulnerability

Teamamaze Amazefilemanager is a file manager application from Teamamaze team for Android devices. A security vulnerability exists in the Teamamaze Amazefilemanager application prior to version 3.4.2, which stems from an intent to control an FTP server that is not properly restricted...

PT-2020-17270

Name of the Vulnerable Software and Affected Versions Amaze File Manager versions prior to 3.4.2 Description The issue concerns the Amaze File Manager application, which does not properly restrict intents for controlling the FTP server. This specifically involves...

CVE-2020-35173: Undefined Security Weakness

The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server aka services.ftpservice.FTPReceiver.ACTIONSTARTFTPSERVER and services.ftpservice.FTPReceiver.ACTIONSTOPFTPSERVER...

Insufficient Policy Enforcement

Insufficient policy enforcement in intent handling in Google Chrome on Android allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page...

Authorization Bypass

chromium is vulnerable to authorization bypass. The vulnerability exists through insufficient policy enforcement in intent handling that allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

Additional Analysis into the SUNBURST Backdoor | McAfee Blogs

ARCHIVED STORY Additional Analysis into the SUNBURST Backdoor Christiaan Beek · DEC 17, 2020 Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoC...

Additional Analysis into the SUNBURST Backdoor | McAfee Blogs

ARCHIVED STORY Additional Analysis into the SUNBURST Backdoor Christiaan Beek · DEC 17, 2020 Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoC...

CVE-2020-27039

In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID:...

CVE-2020-0500

In startInputUncheckedLocked of InputMethodManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2020-27034

In createSimSelectNotification of SimSelectNotification.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

PT-2020-6751

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 84 Description The issue is related to insufficient access control in Firefox for Android, allowing a remote attacker to bypass existing security restrictions. When a malicious application installed on the...

Information Disclosure

chromium is vulnerable to information disclosure. An exposed debugging endpoint in the browser allowes a local attacker to obtain confidential information from process memory via a malicious Intent...