CVE-2017-7759

Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected...

Code injection

Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the contents of the addressbar as displayed to users. Note: This attack only affects Firefox for Android. Other operating systems are not affected. This vulnerabili...

Pwn2Own Huawei HiApp vulnerability principle and the use of analysis of under-vulnerability warning-the black bar safety net

0×01 Preface Pwn2Own Huawei HiApp vulnerability principle and the use of the analysison Reading this article is the basis for understanding previous attacks construct the link. 0×02 vulnerability analysis I don't know if the attentive classmates found in my article analysis article left in the eg...

(Pwn2Own) Samsung Members Intent Proxy Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

CVE-2017-16053

fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Zomato: [Zomato Android/iOS] Theft of user session

Hi, I'd like to report a bug which allows to theft user data even without installing third-party apps. Activity xml is exported, and can be accessed by browser. When any WebView in a client app, or a browser meets a zomato://etc URL it will automatically launch Zomato app. File...

The Third Question(s) Today’s CEOs Should Ask (& Know the Answers To)

In a previous blog, we discussed Commander’s Intent for CEOs and introduced 10 questions CEOs should be asking their teams. In this blog series, I am going to take a deeper dive into each question and break them down one at a time. We will discuss why CEOs should care about each question and the...

CVE-2015-7889

The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICKREPLYBACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain...

CVE-2017-17553

The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...

CVE-2017-17553

The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...

Code injection

The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...

CVE-2017-17553

The vulnerability CVE-2017-17553 affects the Dolphin Browser for Android, version 12.0.2, due to an insecure parsing implementation of the Intent URI scheme. This flaw could allow an attacker to abuse a malicious Intent URI to invoke private Activities within the Dolphin Browser. Root cause: inse...

CVE-2017-17553

The Dolphin Browser for Android 12.0.2 suffers from an insecure parsing implementation of the Intent URI scheme. This vulnerability could allow attackers to abuse this implementation through a malicious Intent URI, in order to invoke private Activities within the Dolphin Browser...

Modifiable Secondary Configuration Values

cordova-android has modifiable secondary configuration values. If an application is created without explicit values set in the config.xml file, attackers can set these variables by using Intent. Leveraging this, they can change the behavior of the application...

CVE-2015-1835

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL...

Code injection

Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables preferences via a crafted intent: URL...

Dropbox: Android - Access of some not exported content providers

The report indicates a flaw in our Android application that would allow a malicious app to gain read/write access to some cached files provided the attacker knows the name of the files and other minor pieces of information. The vulnerability was caused by not validating the package name of an...

Queries regarding app intent and allowed URL schemes

While developing Enterprise app w.r.t app intent and allowed URL schemes we need to follow the below Guide . Android App- How to add Intent Filters for Deep Links, Read Data from Incoming Intents iOS App-How to Implement Custom URL Schemes. XenMobile 10.x Enterprise Apps iPa and APK...

Information Disclosure Through Typo-squatting

acqusition, apidev-coop, bzip, crypt, django-server, pwd, setup-tools, telnet, urlib3, and urllib are packages that are typosquatting other packages with malicious intent. These libraries contain the same source code as the original libraries, however the installation files have been modified to...

Multiple Westermo Router Spoofing Vulnerabilities

The RD-305-DIN, MRD-315, MRD-355, and MRD-455 are all Westermo router devices. A spoofing vulnerability exists in multiple Westermo routers, where an attacker could potentially spoof a user into making a malicious request to a server because the program does not verify that the user intended to...