LLM-Powered Intent-Based Categorization of Phishing Emails

Phishing attacks remain a significant threat to modern cybersecurity, as they successfully deceive both humans and the defense mechanisms intended to protect them. Traditional detection systems primarily focus on email metadata that users cannot see in their inboxes. Additionally, these systems...

CVE-2024-13917 Intent Injection in Kruger&Matz AppLock application

An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.pri.applock.LockUI“ activity allows any other malicious application, with no granted Android system...

CVE-2024-13917 Intent Injection in Kruger&Matz AppLock application

An application "com.pri.applock", which is pre-loaded on Kruger&Matz smartphones, allows a user to encrypt any application using user-provided PIN code or by using biometric data. Exposed ”com.pri.applock.LockUI“ activity allows any other malicious application, with no granted Android system...

CVE-2024-13917

CVE-2024-13917 describes a vulnerability in the pre-installed Krüger&Matz/ Ulefone app “com.pri.applock” where the exposed activity LockUI can be abused by any malicious app (no system permissions) to inject an arbitrary intent with system-level privileges into a protected app. The exploit requir...

Krüger&Matz com.pri.applock 安全漏洞

Krüger&Matz com.pri.applock is a mobile application component from Krüger&Matz. A security vulnerability exists in Krüger&Matz com.pri.applock, which stems from a LockUI activity that allows arbitrary intent injection, potentially resulting in a system-level elevation of privilege...

PT-2025-23312 · Unknown · Com.Pri.Applock

Name of the Vulnerable Software and Affected Versions: com.pri.applock version 13 version code: 33 Description: The issue allows a malicious application to inject an arbitrary intent with system-level privileges to a protected application. This can be done by exploiting the exposed...

AdInject: Real-World Black-Box Attacks on Web Agents Via Advertising Delivery

Vision-Language Model VLM based Web Agents represent a significant step towards automating complex tasks by simulating human-like interaction with websites. However, their deployment in uncontrolled web environments introduces significant security vulnerabilities. Existing research on adversarial...

CVE-2024-20850

Use of Implicit Intent for Sensitive Communication in Samsung Pay prior to version 5.4.99 allows local attackers to access information of Samsung Pay...

CVE-2024-27222

In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due to Intent Redirect GRANTURIPERMISSIONS Attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2024-28745

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displaye...

CVE-2024-20810

Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive information...

CVE-2024-20825

Implicit intent hijacking vulnerability in IAP of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent...

CVE-2024-20826

Implicit intent hijacking vulnerability in UPHelper library prior to version 4.0.0 allows local attackers to access sensitive information via implicit intent...

CVE-2024-20822

Implicit intent hijacking vulnerability in AccountActivity of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent...

CVE-2024-0015

In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-3480

An Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-related data...

CVE-2024-3108

An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization...

CVE-2024-20807

Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information...

CVE-2024-20824

Implicit intent hijacking vulnerability in VoiceSearch of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive information via implicit intent...

CVE-2024-37574

The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivity...