5333 matches found
CVE-2023-42468
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...
Design/Logic Flaw
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...
CVE-2023-42469
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...
CVE-2023-42469
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...
Security feature bypass
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...
CVE-2023-4916 Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Change
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...
CVE-2023-4916
CVE-2023-4916 affects the WordPress plugin Login with phone number . The root cause is missing nonce validation in the function lwp_update_password_action , enabling CSRF that allows unauthenticated attackers to change a user’s password if they can coerce an administrator into performing an actio...
CVE-2023-42468
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...
WordPress plugin Login with phone number Cross-site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. The WordPress plugin Login with phone number suffer...
CVE-2023-42468
CVE-2023-42468 affects the Android app com.cutestudio.colordialer (versions up to 2.1.8-2). The vulnerability stems from an improperly exported DialerActivity, allowing a remote attacker to initiate phone calls without user consent by crafting an android.intent.action.CALL intent with a tel: URI ...
CVE-2023-42469
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...
CVE-2023-42469: Missing Authorization
The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...
CVE-2023-42468: Improper Privilege Management
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...
CVE-2023-4916: Cross-Site Request Forgery (CSRF)
The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...
CVE-2023-42468
The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...
com.full.dialer.top.secure.crypted security vulnerability
com.full.dialer.top.secure.crypted is a library by actuator personal developer. A security vulnerability exists in com.full.dialer.top.secure.crypted 1.0.1 and earlier versions, which stems from allowing any installed application to make a phone call by sending a crafted intent...
Color Phone Security Vulnerability
Color Phone is a dialer with the ability to change themes. A security vulnerability exists in Color Phone version 2.1.8-2 and earlier, which originated from a vulnerability that allows remote attackers to initiate a phone call without the user's consent...
PT-2023-28359 · Unknown · Com.Full.Dialer.Top.Secure.Encrypted
Name of the Vulnerable Software and Affected Versions: com.full.dialer.top.secure.encrypted application version 1.0.1 Description: The issue allows any installed application, without requiring permissions, to place phone calls without user interaction. This is achieved by sending a crafted intent...
Jetpack CRM < 5.5.1 - Client+ XSS
Description The plugin does not sanitise and escape a client's phone number field, which could allow client users to perform Cross-Site Scripting attacks...
PT-2023-31077 · WordPress · Login With Phone Number Plugin For Wordpress
Name of the Vulnerable Software and Affected Versions: Login with phone number plugin for WordPress versions up to, and including, 1.5.6 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the lwp update password action function. This allows...