CVE-2023-42580

CVE-2023-42580 describes improper URL validation in Samsung Galaxy Store’s MCSLaunch deeplink, allowing a JavaScript API to install APKs from Galaxy Store. Affected: Galaxy Store versions before 4.5.64.4. Root cause: URL validation flaw in the deeplink handling. Impact: potential remote code/inst...

CVE-2023-42580

Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to install APK from Galaxy Store...

PT-2023-28451 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.64.4 Description: The issue is related to improper URL validation from InstantPlay deeplink in Galaxy Store, allowing attackers to execute JavaScript API and access data. This can lead to remote code...

CVE-2023-2507

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them...

Code injection

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them...

CVE-2023-2507

CVE-2023-2507 affects CleverTap Cordova Plugin (version 2.6.2). The vulnerability arises from improper validation of data from deeplinks, allowing a remote attacker to execute JavaScript in apps opened via a crafted deeplink (XSS/remote code execution-like behavior described in sources). A patch ...

CVE-2023-2507 CleverTap Cordova Plugin 2.6.2 - Reflected XSS

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them...

CVE-2023-2507 CleverTap Cordova Plugin 2.6.2 - Reflected XSS

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them...

PT-2023-19912 · Clevertap · Clevertap Cordova Plugin

Name of the Vulnerable Software and Affected Versions: CleverTap Cordova Plugin version 2.6.2 Description: The CleverTap Cordova Plugin does not correctly validate the data coming from deeplinks before using them, allowing a remote attacker to execute JavaScript code in any application that is...

CVE-2023-36612

Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses containing...

CVE-2023-36612

Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses containing...

PT-2023-25634 · Basecamp · Com.Basecamp.Bc3

Name of the Vulnerable Software and Affected Versions: com.basecamp.bc3 versions prior to 4.2.1 Description: Directory traversal can occur in the com.basecamp.bc3 application, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a...

CVE-2023-36612

Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the attacker may redirect the server's responses containing...

CVE-2023-36612

The CVE-2023-36612 vulnerability affects the Basecamp com.basecamp.bc3 Android app prior to version 4.2.1, as reported across multiple sources. The issue enables directory traversal, allowing an attacker to write arbitrary files in the app’s private directory. In addition, an attacker could explo...

CVE-2023-24601

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree...

CVE-2023-24601

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree...

Cross site scripting

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree...

CVE-2023-24601

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree...

CVE-2023-24601

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree...

CVE-2023-24601

OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree...