xiaomi-cve-2024-45352

xiaomi-cve-2024-45352 关于小米严重漏洞的技术报告 漏洞摘要 在多种 MIUI 设备上的小米默认浏览器（com.android.browser）中发现了一个漏洞。该应用未能正确验证通过 startActivity 传递的 Intent，从而允许恶意应用打开任意 URL 或执行非预期操作。 CVE 编号 : CVE-2024-45352 组件 :com.android.browser 严重性 : 中危 状态 : 已报告给小米（等待确认） 发现日期 : 2008年4月24日 🔥 概念验证 PoC 1. 使用以下 Intent 创建一个简单的恶意应用：...

TheLastBundleMismatch

神秘的补丁 这次我们从 Android 安全公告 中作为 CVE-2023-45777 修复而出现的补丁开始：diff diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java index 7a19d034c2c8..5238595fe2a2 100644 ---...

Android App "RoboForm Password Manager" insufficient validation of Android intents

Overview Android App "RoboForm Password Manager" provided by Siber Systems, Inc. accepts intents from other applications to open relevant web pages e.g., login pages, but without sufficient URL validation, user confirmation nor notification. Insufficient UI Warning of Dangerous Operations CWE-357...

Exploiting LLM Agent Supply Chains Via Payload-Less Skills

Autonomous agents powered by Large Language Models LLMs acquire external functionalities through third-party skills available in open marketplaces. Adopting these integrations broadens the potential attack surface, prompting a need for systematic security evaluation. Current auditing mechanisms a...

SAMSUNG S Assistant 安全漏洞

SAMSUNG S Assistant is a cell phone application from the South Korean company Samsung SAMSUNG. It provides a cell phone management function. A security vulnerability exists in SAMSUNG S Assistant prior to version 9.3.2, which stems from insufficient validation of intent by...

SAMSUNG S Assistant 安全漏洞

SAMSUNG S Assistant is a cell phone application from the South Korean company Samsung SAMSUNG. It provides a cell phone management function. A security vulnerability exists in SAMSUNG S Assistant prior to version 9.3.2, which stems from insufficient validation of intent by...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices versions prior to SMR Jul-2025 Release 1, which stems from improper broadcast receiver inten...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung cell phone applications. SAMSUNG SMR suffers from a security vulnerability that stems from insufficient validation of intent by the broadcast receiver, which could lead to...

CVE-2024-11700

Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox 133 and Thunderbird 133...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices version 4.9.13.0, which stemmed from an improper intent validation issue in...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices version 4.5.81.0, which stemmed from an improper intent validation issue in...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices version 3.3.35.12, which stemmed from improper validation of intent due to a...

CVE-2023-42471

The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web conte...

Theft of Arbitrary Files due to lack of intent validation and insecure usage of provider paths in TTFViewerActivity.kt

Description Through the use of Oversecured, leading vulnerability scanner for Android and iOS applications, we were able to detect an Theft of Arbitrary Files vulnerability within TTFViewerActivity.kt. Check full issue definition in the image below: Root Cause Analysis The TTFViewerActivity faile...

ASB-A-260567867

In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...

X (Formerly Twitter): Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect

Summary: com.twitter.android.lite.TwitterLiteActivity is set to exported and doesn't validate data pass to intent due to which this activity vulnerable to steal users local files, javascript injection and open redirect. Description: com.twitter.android.lite.TwitterLiteActivity is set to exported ...

Dropbox: Android - Access of some not exported content providers

The report indicates a flaw in our Android application that would allow a malicious app to gain read/write access to some cached files provided the attacker knows the name of the files and other minor pieces of information. The vulnerability was caused by not validating the package name of an...