EUVD-2024-29832

Malicious code in bioql PyPI...

Improper Authorization allows opening of arbitrary files

Description Tested on Build94 of the Inure application. It was discovered that the application had an exported activity .activities.association.TextViewerActivity which accepted intent data via the file scheme + text/ mime type and opened the associated files from provided URI data string. The...

Improper validation of intent data received in TextViewerActivity allows opening of arbitrary files in hamza417/inure

Description Tested on Build89 of the Inure application. It was discovered that the application had an exported activity .activities.association.TextViewerActivity which accepted intent data via the file scheme + text/ mime type and opened the associated files from provided URI data string. The...

Theft of Arbitrary Files due to execution of attacker scripts from BashAssociation.kt

Description Tested on Build87 of the Inure application. It was discovered that the application had an exported activity app.simple.inure.activities.association.BashAssociation which accepted intent data via the file scheme + text/x-shellscript mime type and executed the commands contained within...

Tomato Free Fiction App Has Denial of Service Vulnerability

Tomato Free Novels app is a novel reader that focuses on genuine novels. Tomato Free Novels app has a denial of service vulnerability where an attacker uses a tool to build malformed serialized Intent data to launch the app causing it to crash...

There is a denial-of-service vulnerability in the Demon Quotes Manga App

Demonic Comic App is a mobile comic reader. A denial-of-service vulnerability exists in the Demonic Comics APP. An attacker can exploit the vulnerability to build malformed serialized Intent data to launch the APP causing the application to crash...