Android browser cross-domain data theft, and the Intent of the Scheme to attack-vulnerability warning-the black bar safety net

We next want to introduce this vulnerability, which affects versions of Android 4. 4 The following comes with the browser and some other specific Android browser, which allowed hackers to read the sqlite format of the cookie database file, thereby stealing cookies. Along with this problem, we hav...

CVE-2014-7911

luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted...

Code injection

AndroidManifest.xml in Android before 5.0.0 does not require the SENDSMS permission for the SmsReceiver receiver, which allows attackers to send stored SMS messages, and consequently transmit arbitrary new draft SMS messages or trigger additional per-message charges from a network operator for ol...

Deserialization of untrusted data

luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted...

CVE-2014-7911

CVE-2014-7911 affects Android's deserialization path in ObjectInputStream (Android before 5.0.0). The vulnerability allows an attacker to achieve arbitrary code execution via a crafted serialized object, invoked through an ArrayMap Parcel inside an intent to system_service, demonstrated by the fi...

CVE-2014-8609

The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category...

PT-2014-8650

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.0.0 Description The issue allows attackers to send stored SMS messages and transmit arbitrary new draft SMS messages, or trigger additional per-message charges from a network operator for old messages. This can be...

PT-2014-8649

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.0.0 Description The issue concerns the addAccount method in the Settings application, which does not properly create a PendingIntent. This allows attackers to broadcast an intent with arbitrary component, action, or...

Android SMS Resend Vulnerability

Android versions prior to 5.0 allow an unprivileged application the ability to resend all the SMS's stored in the users phone. INTRODUCTION ================================== In Android 5.0, an unprivileged app can resend all the SMS stored in the user's phone to their corresponding recipients or...

Android Settings Pendingintent Leak Vulnerability

In Android versions prior to 5.0 and possibly greater than and equal to 4.0, Settings application leaks Pendingintent with a blank base intent neither the component nor the action is explicitly set to third party applications. Due to this, a malicious app can use this to broadcast intent with the...

CVE-2014-3502

Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent...

CVE-2014-3500

Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL...

Information disclosure

Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent...

CVE-2014-3500

Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL...

CVE-2014-3502

Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent...

CVE-2014-3500

Apache Cordova for Android (pre-3.5.1) is vulnerable to Cross-Application Scripting via crafted Android intents that can change the start page, enabling an attacker to execute script in the victim’s browser and potentially steal cookie-based credentials. The issue stems from insufficient input va...

CVE-2014-3502

Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent...

CVE-2014-3500

Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL...

PT-2014-5362

Name of the Vulnerable Software and Affected Versions Apache Cordova Android versions prior to 3.5.1 Description The issue allows remote attackers to change the start page via a crafted intent URL. Recommendations For versions prior to 3.5.1, update to version 3.5.1 or later to resolve the issue...

PT-2014-5364

Name of the Vulnerable Software and Affected Versions Apache Cordova Android versions prior to 3.5.1 Description The issue allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent. Recommendations For versions prior to 3.5.1...