CVE-2023-44127

he vulnerability is that the Call management "com.android.server.telecom" app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers...

CVE-2023-44126

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...

CVE-2023-44121

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

Design/Logic Flaw

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...

Design/Logic Flaw

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

Design/Logic Flaw

The vulnerability is that the Messaging "com.android.mms" app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a...

CVE-2023-44129

Summary: CVE-2023-44129 affects LG-patched Android Messaging (com.android.mms) via the exported activity com.android.mms.ui.QClipIntentReceiverActivity. An attacker can trigger the activity, broadcast the action com.lge.message.action.QCLIP, and send their own data with Intent.FLAG_GRANT_*; the p...

CVE-2023-44129 Messaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivity

The vulnerability is that the Messaging "com.android.mms" app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a...

CVE-2023-44127 Call management - Implicit activity intents disclose contact details and phone numbers

he vulnerability is that the Call management "com.android.server.telecom" app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers...

CVE-2023-44127 Call management - Implicit activity intents disclose contact details and phone numbers

he vulnerability is that the Call management "com.android.server.telecom" app patched by LG launches implicit intents that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as contact details and phone numbers...

CVE-2023-44127

CVE-2023-44127 involves LG-patched call management (com.android.server.telecom). The issue is that it launches implicit intents which disclose sensitive data (e.g., contact details and phone numbers) to all third-party apps on the same device. Exploitation details are not provided in the document...

CVE-2023-44126 Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...

CVE-2023-44126

The CVE-2023-44126 issue concerns the Android Call management component (com.android.server.telecom) patched by LG. The vulnerability arises because LG’s patch sends a large number of LG-owned implicit broadcasts that disclose sensitive telephony data to all third-party apps on the same device. T...

CVE-2023-44126 Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...

CVE-2023-44123

The CVE-2023-44123 issue affects com.lge.bluetoothsetting and arises from using implicit PendingIntents with PendingIntent.FLAG_MUTABLE, enabling theft/over-write of arbitrary files with system privilege. An attacker’s app with access to notifications could intercept them, redirect to its activit...

CVE-2023-44121

CVE-2023-44121 describes an intent redirection in LG ThinQ Service (com.lge.lms2), specifically in NotificationManager.java, exploitable by a third‑party app via a broadcast with action com.lge.lms.things.notification.ACTION. The vulnerability is dangerous because LG ThinQ Service is a system app...

CVE-2023-44121 LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

CVE-2023-44121 LG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhere

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

CVE-2023-44121: Improper Export of Android Application Components

The vulnerability is an intent redirection in LG ThinQ Service "com.lge.lms2" in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action...

CVE-2023-44126: Improper Verification of Intent by Broadcast Receiver

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...