PT-2023-28418 · Samsung · Samsung Account

Name of the Vulnerable Software and Affected Versions: Samsung Account versions prior to 14.5.00.7 Description: The issue concerns the use of implicit intent for sensitive communication in the startSignIn function of Samsung Account, allowing attackers to access arbitrary files with Samsung Accou...

PT-2023-28410

Name of the Vulnerable Software and Affected Versions Bixby Voice versions prior to 3.3.35.12 Description The issue is related to improper verification of intent by a broadcast receiver in Bixby Voice, allowing attackers to access arbitrary data with Bixby Voice privilege. Recommendations For...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung. A security vulnerability exists in SAMSUNG Mobile devices due to an implicit intent hijacking vulnerability in the Firewall application module. The vulnerabili...

CVE-2023-42547: Exposure of Resource to Wrong Sphere

Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

PT-2023-28416

Name of the Vulnerable Software and Affected Versions Samsung Account versions prior to 14.5.00.7 Description The issue concerns the use of implicit intent for sensitive communication in the startNameValidationActivity function within Samsung Account. This allows attackers to access arbitrary fil...

PT-2023-28420 · Google · Android 12 +2

Name of the Vulnerable Software and Affected Versions: Firewall application versions prior to 12.1.00.24 in Android 11 Firewall application versions prior to 13.1.00.16 in Android 12 Firewall application versions prior to 14.1.00.7 in Android 13 Description: The issue allows a 3rd party applicati...

PT-2023-28423

Name of the Vulnerable Software and Affected Versions EasySetup versions prior to 11.1.13 Description The issue concerns the use of implicit intent for sensitive communication in EasySetup, allowing attackers to obtain the Bluetooth address of a user's device. Recommendations For versions prior t...

CVE-2023-42551: Exposure of Resource to Wrong Sphere

Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

CVE-2023-42549: Exposure of Resource to Wrong Sphere

Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitrary file with Samsung Account privilege...

CVE-2023-42540: Improper Access Control

Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via implicit intent...

PT-2023-28415 · Samsung · Samsung Account

Name of the Vulnerable Software and Affected Versions: Samsung Account versions prior to 14.5.00.7 Description: The issue concerns the use of implicit intent for sensitive communication in the startMandatoryCheckActivity function within Samsung Account. This allows attackers to access arbitrary...

GHSA-7VFX-HFVM-RHR8 cordova-plugin-fingerprint-aio DoS vulnerability

Summary: Sending a specially crafted intent with an invalid/empty extras de.niklasmerz.cordova.biometric.BiometricActivity can cause the app to crash. sending the intent repeatedly can prevent the app using this plugin from working, resulting in a denial of service DoS condition. Impact A 3rd par...

cordova-plugin-fingerprint-aio DoS vulnerability

Summary: Sending a specially crafted intent with an invalid/empty extras de.niklasmerz.cordova.biometric.BiometricActivity can cause the app to crash. sending the intent repeatedly can prevent the app using this plugin from working, resulting in a denial of service DoS condition. Impact A 3rd par...

ASB-A-272024837

In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of systemserver due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2023-21384

In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21312

In IntentResolver, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability, which is caused by an insecure PendingIntent in Package Manager. The vulnerability can be exploited by an attacker to obtain sensitive information...

Hardcoded credentials

The vulnerability allows an unprivileged untrusted third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcode...

CVE-2023-41372

The CVE-2023-41372 issue affects the Android Client application. It allows an unprivileged third‑party app to arbitrarily modify the client’s server settings, causing the device to connect to an attacker‑controlled malicious server. Root cause: forging a valid broadcast intent encrypted with a ha...

CVE-2023-41372: Use of Hard-coded Credentials

The vulnerability allows an unprivileged untrusted third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcode...