25 matches found
CVE-2015-7191: Improper Neutralization of Input During Web Page Generation
Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting XSS attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS UXSS."...
CVE-2014-3500
Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL...
CVE-2014-3500
Apache Cordova for Android (pre-3.5.1) is vulnerable to Cross-Application Scripting via crafted Android intents that can change the start page, enabling an attacker to execute script in the victim’s browser and potentially steal cookie-based credentials. The issue stems from insufficient input va...
