CVE-2020-8954: Incorrect Default Permissions

OpenSearch Web browser 1.0.4.9 allows Intent Scheme Hijacking.a link that opens another app in the browser can be manipulated...

CVE-2020-6827

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

CVE-2020-6828

Mode C - Detailed summary: CVE-2020-6828 affects Firefox for Android and is part of a set of fixes in Firefox ESR updates. The vulnerability arises when a malicious Android app crafts an Intent that Firefox for Android processes, potentially enabling a crafted user.js to overwrite preferences in ...

CVE-2020-6828

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference value...

CVE-2020-6827: Improper Restriction of Rendered UI Layers or Frames

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. Note: This issue only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox ESR...

Shopify: Account takeover intercepting magic link for Arrive app

Summary The "magic link" used for login by Arrive app uses Branch.io to pass the login token via deeplink to the app. But the URL contained in the link app.link domain is not verified so it can be intercepted by a malicious app at takeover the account. Description When trying to login with Arrive...

CVE-2020-0082

In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. This could lead to local escalation of privilege to systemserver with no additional execution privileges needed. User interaction is not needed for...

Deserialization of untrusted data

In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. This could lead to local escalation of privilege to systemserver with no additional execution privileges needed. User interaction is not needed for...

openSUSE Security Update : MozillaFirefox (openSUSE-2020-493)

This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues : - CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method bsc1168874. - CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images bsc1168874. -...

CVE-2018-21071

An issue was discovered on Samsung mobile devices with M6.0 software. Because of an unprotected intent, an attacker can read arbitrary files and emails, and take over an email account. The Samsung ID is SVE-2018-11633 May 2018...

CVE-2018-21071

An issue was discovered on Samsung mobile devices with M6.0 software. Because of an unprotected intent, an attacker can read arbitrary files and emails, and take over an email account. The Samsung ID is SVE-2018-11633 May 2018...

CVE-2018-21071

An issue was discovered on Samsung mobile devices with M6.0 software. Because of an unprotected intent, an attacker can read arbitrary files and emails, and take over an email account. The Samsung ID is SVE-2018-11633 May 2018...

CVE-2020-6828

The Mozilla Foundation Security Advisory describes this flaw as: A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to...

CVE-2018-21071: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered on Samsung mobile devices with M6.0 software. Because of an unprotected intent, an attacker can read arbitrary files and emails, and take over an email account. The Samsung ID is SVE-2018-11633 May 2018...

CVE-2017-18686

An issue was discovered on Samsung mobile devices with M6.0 and N7.0 software. Contact information can leak to a log file because of the broadcasting of an unprotected intent. The Samsung ID is SVE-2016-7180 February 2017...

CVE-2017-18685

An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, and M6.0 software. The InputMethod application can cause a system crash via a malformed serializable object in an Intent. The Samsung ID is SVE-2016-7123 February 2017...

CVE-2017-18682

An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, M6.0, and N7.0 software. Because of incorrect exception handling and an unprotected intent, AudioService can cause a system crash, The Samsung IDs are SVE-2017-8114, SVE-2017-8116, and SVE-2017-8117 March 2017...

CVE-2017-18685

An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, and M6.0 software. The InputMethod application can cause a system crash via a malformed serializable object in an Intent. The Samsung ID is SVE-2016-7123 February 2017...

CVE-2017-18682

An issue was discovered on Samsung mobile devices with KK4.4, L5.0/5.1, M6.0, and N7.0 software. Because of incorrect exception handling and an unprotected intent, AudioService can cause a system crash, The Samsung IDs are SVE-2017-8114, SVE-2017-8116, and SVE-2017-8117 March 2017...

CVE-2017-18686

An issue was discovered on Samsung mobile devices with M6.0 and N7.0 software. Contact information can leak to a log file because of the broadcasting of an unprotected intent. The Samsung ID is SVE-2016-7180 February 2017...