147 matches found
Input validation
Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink...
CVE-2022-30717
Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink...
CVE-2022-30717
The CVE-2022-30717 entry concerns Samsung AR Emoji prior to SMR Jun-2022 Release 1, with an underlying issue described as an improper caller check. The vulnerability allows untrusted applications to access certain camera functions via deeplink, presenting a remote-like risk without user interacti...
PT-2022-20254 · Samsung · Ar Emoji
Name of the Vulnerable Software and Affected Versions: AR Emoji versions prior to SMR Jun-2022 Release 1 Description: The issue is related to an improper caller check in AR Emoji, which allows untrusted applications to use some camera functions via deeplink. Recommendations: For AR Emoji versions...
CVE-2022-28799
The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...
CVE-2022-28799
The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...
CVE-2022-28799
The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL unvalidated deeplink can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click...
TikTok: One Click Account Hijacking via Unvalidated Deeplink
A WebView Hijacking vulnerability was found on the TikTok Android application via an un-validated deeplink on an un-sanitized parameter. This could have resulted in account hijacking through a JavaScript interface. We thank @fr4via for reporting this to our team...
CVE-2021-25520
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...
CVE-2021-25521
Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet...
CVE-2021-25520
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...
CVE-2021-25521
Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet...
CVE-2021-25520
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...
Code injection
Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet...
CVE-2021-25521
CVE-2021-25521 affects Samsung Internet prior to version 16.0.2. The issue is an insecure check in the sharevia deeplink logic, enabling untrusted applications to obtain the user’s current tab URL in Samsung Internet. This is a local issue tied to the deeplink handling, with impact limited to con...
CVE-2021-25521
Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get current tab URL in Samsung Internet...
CVE-2021-25520
CVE-2021-25520 affects Samsung Internet prior to version 16.0.2. The vulnerability arises from insecure caller checks and input validation in the SearchKeyword deeplink logic, allowing untrusted applications to execute script code in the browser. The impact is cross-origin script execution with p...
CVE-2021-25520
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...
Google Assistant Authentication Bypass Vulnerability
Google Assistant suffered from an authentication bypass vulnerability allowing a webpage to execute commands without permission. Auth Bypass in Google Assistant Summary: Webpage can execute Google Assistant commands without any permissions Steps to reproduce: Generate the TTS audio files using th...
CVE-2021-25374
An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O8.1 and below, and 3.9.00.9 in Android P9.0 and above allows remote attackers to access a user data related with Samsung Account...