...[ More ]

Android's CALLPHONE permission allows applications to execute carrier MMI/USSD codes without user confirmation. ACR Phone / Cube ACR exposes a browser-accessible intent handler that can be abused to execute these codes when the application has CALLPHONE permission and is configured as the default...

CVE-2024-36064

The NLL com.nll.cb aka ACR Phone application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component...

CVE-2024-36064: Improper Neutralization of Input During Web Page Generation

The NLL com.nll.cb aka ACR Phone application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component...

PT-2024-26876

Name of the Vulnerable Software and Affected Versions com.nll.cb aka ACR Phone versions 0.330-playStore-NoAccessibility-arm8 and earlier Description The issue allows any installed application, without requiring permissions, to place phone calls without user interaction. This is achieved by sendin...

CVE-2024-36064

The NLL com.nll.cb (known as ACR Phone ) application for Android, specifically versions through 0.330-playStore-NoAccessibility-arm8 , contains a security vulnerability. A malicious application installed on the same device can place phone calls without user interaction by sending a crafted intent...