CVE-2021-25520

Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...

Google Assistant Authentication Bypass Vulnerability

Google Assistant suffered from an authentication bypass vulnerability allowing a webpage to execute commands without permission. Auth Bypass in Google Assistant Summary: Webpage can execute Google Assistant commands without any permissions Steps to reproduce: Generate the TTS audio files using th...

CVE-2021-25374

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O8.1 and below, and 3.9.00.9 in Android P9.0 and above allows remote attackers to access a user data related with Samsung Account...

CVE-2021-25374

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O8.1 and below, and 3.9.00.9 in Android P9.0 and above allows remote attackers to access a user data related with Samsung Account...

CVE-2021-25374

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O8.1 and below, and 3.9.00.9 in Android P9.0 and above allows remote attackers to access a user data related with Samsung Account...

Authorization

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O8.1 and below, and 3.9.00.9 in Android P9.0 and above allows remote attackers to access a user data related with Samsung Account...

CVE-2021-25374

The CVE-2021-25374 entry refers to an improper authorization vulnerability in Samsung Members deeplink scheme "samsungrewards". Affected are Samsung Members in versions 2.4.83.9 (Android O 8.1 and below) and 3.9.00.9 (Android P 9.0 and above). The issue potentially allows remote attackers to acce...

CVE-2021-25354

Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink...

CVE-2021-25354

Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink...

Input validation

Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink...

CVE-2021-25354

The CVE-2021-25354 entry affects Samsung Internet (Samsung Browser). The issue is an improper input check in versions prior to 13.2.1.46, which can be exploited via a malicious deeplink to launch non-exported activities in the browser. Impact is that an attacker could trigger unintended activity ...

CVE-2021-25354

Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink...

PT-2021-16547 · Samsung · Samsung Internet

Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 13.2.1.46 Description: The issue is related to an improper input check in Samsung Internet, which allows attackers to launch non-exported activity in Samsung Browser via a malicious deeplink. Recommendations...

Samsung Internet 安全漏洞

Samsung Internet is a cell phone application from Samsung South Korea. It provides a browser function. A security vulnerability exists in Samsung Internet prior to version 13.2.1.46, which can be exploited by an attacker to launch unexported activities in Samsung Browser via a malicious deeplink...

Snapchat: CSRF when unlocking lenses leads to lenses being forcefully installed without user interaction

Hi, The url below allows a user to unlock a particular lens. Once they have opened the URL on their phone, Snapchat opens up and prompts the user to unlock this lens. https://www.snapchat.com/unlock/?type=SNAPCODE&uuid=6ff5a565fca249a1948b1963ee2881b4&metadata=01 By changing the value of type in...

OnionSearch - A Script That Scrapes Urls On Different .Onion Search Engines

OnionSearch is a Python3 script that scrapes urls on different ".onion" search engines. Prerequisite Python 3  Currently supported Search engines ahmia darksearchio onionland notevil darksearchenginer phobos onionsearchserver torgle onionsearchengine tordex tor66 tormax haystack multivac evosear...

New Relic: Adding your account to victim's app via deeplink

At your android app, there is a feature for passwordless login. It sends an email and if you click the link, it triggers a deeplink on the app for login. I think this feature needs a state control, for example setting loginstatetoken=ABC on the requester device and adding this loginstatetoken to...

CVE-2020-11882

The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle deeplinks that can be delivered either via links or by directly calling the activity. However, the deeplink format is not properly...

CVE-2020-11882

The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle deeplinks that can be delivered either via links or by directly calling the activity. However, the deeplink format is not properly...

Shopify: Account takeover intercepting magic link for Arrive app

Summary The "magic link" used for login by Arrive app uses Branch.io to pass the login token via deeplink to the app. But the URL contained in the link app.link domain is not verified so it can be intercepted by a malicious app at takeover the account. Description When trying to login with Arrive...