78632 matches found
MobSF has SSRF port restriction bypass in assetlinks_check
Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...
CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check
MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...
CVE-2026-68922
In MobSF versions before 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py constructs paths from the manifest android:icon value without sanitizing traversal or verifying containment. An authenticated user can upload a crafted ZIP/APK to read server files matching A...
CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads
MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...
CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74951
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...
EUVD-2026-60693
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74980 Clickjacking issue in the Downloads component in Firefox for Android
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74980
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74980
A clickjacking flaw in Firefox for Android's Downloads component allows a malicious page to trick users into unintended downloads. CVSS 6.5 (MEDIUM), network-accessible with user interaction. Fixed in Firefox 154; the Nessus plugin confirms no in-the-wild exploitation is known.
CVE-2026-74975
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
EUVD-2026-60689
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74975 Spoofing issue in the Downloads component in Firefox for Android
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74975
A spoofing issue in the Downloads component of Firefox for Android allows a remote attacker to trick users into downloading or interacting with malicious content, with CVSS 5.4 (MEDIUM). It was fixed in Firefox 154. No in-the-wild exploitation is reported.
CVE-2026-74951
CVE-2026-74951 is a clickjacking vulnerability in Firefox for Android , fixed in Firefox 154 . The flaw allows an attacker to trick a user into performing unintended actions by overlaying transparent or invisible UI elements. The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N...
CVE-2026-74951 Clickjacking issue in Firefox for Android
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...
CVE-2026-74951
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...
