Authorization

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

CVE-2019-5767

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

CVE-2019-5767

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

Keyfinder - A Tool For Finding And Analyzing Private (And Public) Key Files, Including Support For Android APK Files

CERT Keyfinder is a utility for finding and analyzing key files on a filesystem as well as contained within Android APK files. CERT Keyfinder development was sponsored by the United States Department of Homeland Security DHS. Installation requirements: 1. Python 3.x recommended androguard...

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

Remote code execution

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

CVE-2018-1000849

CVE-2018-1000849 affects Alpine Linux, where the package manager apk-tools prior to versions 2.6.10, 2.7.6, and 2.10.1 contains a vulnerability that can lead to remote code execution. The root cause is described as bugs in handling long link target names and in the extraction of regular files, al...

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

CVE-2018-2482

SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Install the Mobile Secure Android client released in Mid-Oct 2018...

CVE-2018-2482

SAP Mobile Secure for Android (Mobile-secure.apk) prior to version 6.60.19942.0 is affected by a Denial of Service condition where an attacker can cause service disruption by crashing or flooding. The issue impacts the Android client component and is mitigated by updating to the released mid-Octo...

Code Execution Vulnerability in Poundland App for Android

The Poundland App is a software that focuses on providing online group buying of goods at low prices. A code execution vulnerability exists in the Android version of Pinduoduo APP. An attacker can exploit the vulnerability to induce users to install a modified APK and execute arbitrary code...

Dex2Jar - Tools To Work With Android .Dex And Java .Class Files

dex2jar Tools to work with android .dex and java .class files 1. dex-reader/writer: Read/write the Dalvik Executable .dex file. It has a light weight API similar with ASM. 2. d2j-dex2jar: Convert .dex file to .class files zipped as jar 3. smali/baksmali: disassemble dex to smali files and assembl...

MensaMax 4.3 Hardcoded Encryption Key Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 e2 Security GmbH Advisory 2018-01 Unencrypted transmission and usage of hardcoded encryption key Overview Advisory ID: E2SA-2018-01 Advisory Version: 1.0 Advisory Status: Public Advisory URL: https://advisories.e2security.de/2018/E2SA-2018-01.txt...

app-bundle-info (>=0.0.4 <=0.2.2), chromeos-apk (>=1.0.0 <=2.0.0) +1 more potentially affected by CVE-2016-10632 via apk-parser2 (=0.1.1)

apk-parser2 NPM version =0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on apk-parser2 and may be impacted: - app-bundle-info =0.0.4, =1.0.0, =1.0.0, =1.1.0 Source cves: CVE-2016-10632 Source advisory: OSV:GHSA-HXHM-3VJ9-6CQH...

apk-parser2 downloads Resources over HTTP

Affected versions of apk-parser2 insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

GHSA-HXHM-3VJ9-6CQH apk-parser2 downloads Resources over HTTP

Affected versions of apk-parser2 insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...

MobSF (Mobile Security Framework) v1.0 - Mobile (Android/iOS) Automated Pen-Testing Framework

Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing framework capable of performing static, dynamic and malware analysis. It can be used for effective and fast security analysis of Android, iOS and Windows mobile applications and support...

Fortnite Android App Falls Victim to Man-in-the-Disk Flaw

Epic Games has patched a critical man-in-the-disk MiTD flaw for the Android version of the wildly popular Fortnite game – although controversy has swirled after Google decided to ignore a 90-day disclosure request from the gaming company. The issue exists in the Fortnite Installer, which download...

Critical Flaw in Fortnite Android App Lets Hackers Install Malware

Security researchers from Google have publicly disclosed an extremely serious security flaw in the first Fortnite installer for Android that could allow other apps installed on the targeted devices to manipulate installation process and load malware, instead of the Fortnite APK. Earlier this mont...