2442 matches found
CVE-2017-16053
fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...
Zomato: [Zomato Android/iOS] Theft of user session
Hi, I'd like to report a bug which allows to theft user data even without installing third-party apps. Activity xml is exported, and can be accessed by browser. When any WebView in a client app, or a browser meets a zomato://etc URL it will automatically launch Zomato app. File...
The Third Question(s) Today’s CEOs Should Ask (& Know the Answers To)
In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...
CVE-2015-7889
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICKREPLYBACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain...
CVE-2017-17553
The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...
CVE-2017-17553
The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...
Code injection
The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...
CVE-2017-17553
The vulnerability CVE-2017-17553 affects the Dolphin Browser for Android, version 12.0.2, due to an insecure parsing implementation of the Intent URI scheme. This flaw could allow an attacker to abuse a malicious Intent URI to invoke private Activities within the Dolphin Browser. Root cause: inse...
CVE-2017-17553: Undefined Security Weakness
The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...
CVE-2017-17553
The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...
Modifiable Secondary Configuration Values
cordova-android has modifiable secondary configuration values. If an application is created without explicit values set in the config.xml file, attackers can set these variables by using Intent. Leveraging this, they can change the behavior of the application...
Code injection
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL...
CVE-2015-1835
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL...
CVE-2015-1835: Improper Input Validation
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL...
Dropbox: Android - Access of some not exported content providers
The report indicates a flaw in our Android application that would allow a malicious app to gain read/write access to some cached files provided the attacker knows the name of the files and other minor pieces of information. The vulnerability was caused by not validating the package name of an...
Queries regarding app intent and allowed URL schemes
While developing Enterprise app w.r.t app intent and allowed URL schemes we need to follow the below Guide . Android App- How to add Intent Filters for Deep Links, Read Data from Incoming Intents iOS App-How to Implement Custom URL Schemes. XenMobile 10.x Enterprise Apps iPa and APK...
Information Disclosure Through Typo-squatting
acqusition, apidev-coop, bzip, crypt, django-server, pwd, setup-tools, telnet, urlib3, and urllib are packages that are typosquatting other packages with malicious intent. These libraries contain the same source code as the original libraries, however the installation files have been modified to...
Multiple Westermo Router Spoofing Vulnerabilities
The RD-305-DIN, MRD-315, MRD-355, and MRD-455 are all Westermo router devices. A spoofing vulnerability exists in multiple Westermo routers, where an attacker could potentially spoof a user into making a malicious request to a server because the program does not verify that the user intended to...
Mozilla Firefox for Android Local Security Bypass Vulnerability
Mozilla Firefox for Android is an open source web browser based on the Android platform from the US-based Mozilla Foundation. A security vulnerability exists in versions of Mozilla Firefox for Android prior to version 54. The vulnerability can be exploited by an attacker to read local data with t...
