PT-2019-14137

Name of the Vulnerable Software and Affected Versions Asus ZenFone 5 Lite Android device with a build fingerprint of asus/WW Phone/ASUS X017D 1:7.1.1/NMF26F/14.0400.1810.061-20181107:user/release-keys Description The device contains a pre-installed app with a package name of...

CVE-2019-15408: Undefined Security Weakness

The Asus ZenFone 5 Lite Android device with a build fingerprint of asus/WWPhone/ASUSX017D1:7.1.1/NMF26F/14.0400.1810.061-20181107:user/release-keys contains a pre-installed app with a package name of com.asus.loguploaderproxy app versionCode=1570000020, versionName=7.0.0.4170901 that allows other...

CVE-2019-15472: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app versionCode=28, versionName=9 that allows unauthorized microphon...

PT-2019-14067

Name of the Vulnerable Software and Affected Versions Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88 lite/iris88 lite:8.1.0/O11019/1536323070:user/release-keys com.android.lava.powersave app version v4.0.27 Description The issue concerns a pre-installed app that allows a...

PT-2019-14102

Name of the Vulnerable Software and Affected Versions Symphony i95 Lite Android device with a build fingerprint of LAVA/iris88 lite/iris88 lite:8.1.0/O11019/1536323070:user/release-keys com.mediatek.wfo.impl app version 8.1.0 Description The issue concerns a pre-installed app that allows any...

PT-2019-14202

Name of the Vulnerable Software and Affected Versions Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/jasmine/jasmine sprout:9/PKQ1.180904.001/V10.0.2.0.PDIMIFJ:user/release-keys com.qualcomm.qti.callenhancement app version 9 versionCode=28 Description The issue allows...

PT-2019-14103

Name of the Vulnerable Software and Affected Versions Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88 lite/iris88 lite:8.1.0/O11019/1536323070:user/release-keys Description The issue concerns a pre-installed app with a package name of com.mediatek.wfo.impl that allows any...

CVE-2019-15473: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/jasmine/jasminesprout:9/PKQ1.180904.001/V10.0.2.0.PDIMIFJ:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app versionCode=28, versionName=9 that allows unauthorized...

PT-2019-14201

Name of the Vulnerable Software and Affected Versions Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys com.qualcomm.qti.callenhancement app version 9 versionCode=28 Description The issue allows unauthorize...

CVE-2019-15468: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201812071953 that allows unauthorized wireles...

CVE-2019-5292

Honor 10 Lite, Honor 8A, Huawei Y6 mobile phones with the versions before 9.1.0.217C00E215R3P1, the versions before 9.1.0.205C00E97R1P9, the versions before 9.1.0.205C00E97R2P2 have an information leak vulnerability. Due to improper function error records of some module, an attacker with the acce...

CVE-2019-5292

Honor 10 Lite, Honor 8A, Huawei Y6 mobile phones with the versions before 9.1.0.217C00E215R3P1, the versions before 9.1.0.205C00E97R1P9, the versions before 9.1.0.205C00E97R2P2 have an information leak vulnerability. Due to improper function error records of some module, an attacker with the acce...

CVE-2019-5292: Undefined Security Weakness

Honor 10 Lite, Honor 8A, Huawei Y6 mobile phones with the versions before 9.1.0.217C00E215R3P1, the versions before 9.1.0.205C00E97R1P9, the versions before 9.1.0.205C00E97R2P2 have an information leak vulnerability. Due to improper function error records of some module, an attacker with the acce...

Huawei Honor 10 Lite, Honor 8A and Huawei Y6 Information Disclosure Vulnerability

The Huawei Honor 10 Lite, among others, is a smartphone from the Chinese company Huawei Huawei. An information disclosure vulnerability exists in Huawei Honor 10 Lite prior to version 9.1.0.217 C00E215R3P1, Honor 8A prior to version 9.1.0.205 C00E97R1P9, and Huawei Y6 prior to version 9.1.0.205...

PT-2019-5376

Name of the Vulnerable Software and Affected Versions Honor 10 Lite versions prior to 9.1.0.217C00E215R3P1 Honor 8A versions prior to 9.1.0.205C00E97R1P9 Huawei Y6 versions prior to 9.1.0.205C00E97R2P2 Description The issue is related to improper function error records of some module, which may...

Etherpad-Lite Cross-Site Scripting Vulnerability

Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A cross-site scripting vulnerability exists in the templates/pad.html page in Etherpad-Lite version 1.7.5, which stems from a lack of proper validation of client-side data in the WEB application and can be...

CVE-2019-18209

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...

CVE-2019-18209

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...

Default credentials

templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...

CVE-2019-18209

CVE-2019-18209 affects Etherpad-Lite 1.7.5, with XSS in templates/pad.html when the browser does not encode the URL path (demonstrated in Internet Explorer). The root cause is lack of proper validation/encoding of client-side data in that page. Public disclosures in multiple feeds confirm the iss...