CVE-2025-9671 UAB Paytend App com.passport.cash AndroidManifest.xml improper export of android application components

A weakness has been identified in UAB Paytend App up to 2.1.9 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.passport.cash. Executing manipulation can lead to improper export of android application components. The attack needs to be launched...

PT-2025-35312

Name of the Vulnerable Software and Affected Versions: Voice Changer App versions up to 1.1.0 Description: A vulnerability exists in Voice Changer App due to improper export of Android application components resulting from unknown processing of the AndroidManifest.xml file within the...

PT-2025-35311

Name of the Vulnerable Software and Affected Versions: Transbyte Scooper News App versions up to 1.2 Description: A flaw exists in Transbyte Scooper News App up to version 1.2 on Android, related to improper export of android application components due to manipulation of the AndroidManifest.xml...

Modo Legend of the Phoenix 安全漏洞

Modo Legend of the Phoenix is a mobile game by China Modo. A security vulnerability exists in Modo Legend of the Phoenix 1.0.5 and earlier versions, which stems from improper component export in the file AndroidManifest.xml and could lead to a local attack...

Kakao Hey Kakao App 安全漏洞

Kakao Hey Kakao App is a messaging app from the South Korean company Kakao. A security vulnerability exists in Kakao Hey Kakao App version 2.17.4 and earlier, which stems from improper component export in the file AndroidManifest.xml and could lead to a local attack...

UAB Paytend App 安全漏洞

UAB Paytend App is a banking mobile application from UAB Paytend. A security vulnerability exists in UAB Paytend App version 2.1.9 and earlier, which stems from improper component export in the file AndroidManifest.xml and could lead to a local attack...

NCSOFT Universe App 安全漏洞

NCSOFT Universe App is a mobile game by South Korean company NCSOFT. A security vulnerability exists in NCSOFT Universe App version 1.3.0 and earlier, which stems from improper component export in the file AndroidManifest.xml and could lead to a local attack...

Transbyte Scooper News App 安全漏洞

Transbyte Scooper News App is a news app from Transbyte, a Hong Kong, China-based company. A security vulnerability exists in Transbyte Scooper News App version 1.2 and earlier, which stems from improper component export in the file AndroidManifest.xml and could lead to a local attack...

Rejseplanen App 安全漏洞

Rejseplanen App is a mobile application from Rejseplanen, a Danish company, that has the ability to look up information about the specific operation of buses, trains, and locations in Denmark. A security vulnerability exists in Rejseplanen App version 8.2.2 and earlier, which stems from improper...

Baviux Voice Changer App 安全漏洞

Baviux Voice Changer App is a voice changer software from Baviux. A security vulnerability exists in Baviux Voice Changer App version 1.1.0 and earlier, which stems from improper component export in the file AndroidManifest.xml, and could lead to a local attack...

PT-2025-35320

Name of the Vulnerable Software and Affected Versions: NCSOFT Universe App versions up to 1.3.0 Description: A vulnerability exists due to improper export of android application components within the AndroidManifest.xml file of the com.ncsoft.universeapp component. Local access is required for...

PT-2025-35321

Name of the Vulnerable Software and Affected Versions: Modo Legend of the Phoenix versions through 1.0.5 Description: A security flaw exists in Modo Legend of the Phoenix due to improper export of android application components. The affected element is a function within the AndroidManifest.xml fi...

PT-2025-35309

Name of the Vulnerable Software and Affected Versions: Rejseplanen App versions up to 8.2.2 Description: A security issue has been identified in the Rejseplanen App related to improper export of android application components due to manipulation of an unknown function within the AndroidManifest.x...

CVE-2025-58049

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki...

CVE-2025-58049 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki...

CVE-2025-58049 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki...

CVE-2025-58049

CVE-2025-58049 affects XWiki Platform components where PDF export jobs serialize request context, including cookies, into job status files. The root cause is unencrypted storage of user cookies (potentially exposing credentials) in the permanent data directory after a PDF export completes. Affect...

CVE-2025-58049 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki...

GHSA-9M7C-M33F-3429 XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

Impact The PDF export uses a background job that runs on the server-side. Jobs like this have a status that is serialized in the permanent directory when the job is finished. The job status includes the job request. The PDF export job request is initialized, before the job starts, with some conte...

CVE-2025-54029

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-export allows Path Traversal.This issue affects WooCommerce csv import export: from n/a through = 2.0.6...