X (Formerly Twitter): Following a User After Favoriting Actually Follows Another User (related to #95243)

Hi, There appears to be a bug similar to 95243 which affects following a user after favoriting one of their tweets via an Intent dialog. The following is a proof of concept: https://twitter.com/intent/favorite/?tweetid=661625230297821184&screenname=ericrtest3 The screenname param submits with the...

ok.ru: Multiple critical vulnerabilities in Odnoklassniki Android application

Hello, I have recently found several critical vulnerabilities in Odnoklassniki Android application, which is one of your projects, thus I am reporting it here. The first vulnerability is so called Intent spoofing. The vulnerability lies in ability to start the video upload activity of Odnoklassni...

Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge

Posted by Natalie Silvanovich, Planner of Bug Bashes Recently, Project Zero researched a popular Android phone, the Samsung Galaxy S6 Edge. We discovered and reported 11 high-impact security issues as a result. This post discusses our motivations behind the research, our approach in looking for...

X (Formerly Twitter): Following a User Actually Follows Another User

I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:...

Design/Logic Flaw

The SIM Toolkit STK framework in Android before 5.1.1 LMY48I allows attackers to 1 intercept or 2 emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171...

Deserialization of untrusted data

The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka...

CVE-2015-1541

CVE-2015-1541 affects Android before version 5.1.1 (LMY48I). The issue resides in AppWidgetServiceImpl in Settings, where an application can obtain a URI permission by sending an Intent with FLAG_GRANT_READ_URI_PERMISSION or FLAG_GRANT_WRITE_URI_PERMISSION. This bypasses intended restrictions and...

CVE-2015-3837

CVE-2015-3837 affects Android’s OpenSSLX509Certificate class (org/conscrypt/OpenSSLX509Certificate.java) in builds prior to 5.1.1 LMY48I. The root cause is improper inclusion of certain context data during serialization and deserialization, enabling a malicious local application to trigger code e...

CVE-2015-1541

The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a 1 FLAGGRANTREADURIPERMISSION or 2...

CVE-2015-3837: Improper Input Validation

The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka...

CVE-2015-3843

The SIM Toolkit STK framework in Android before 5.1.1 LMY48I allows attackers to 1 intercept or 2 emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171...

CVE-2015-1541: Improper Access Control

The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a 1 FLAGGRANTREADURIPERMISSION or 2...

Vulnerabilities Identified in Dolphin, Mercury Android Browsers

Vulnerabilities exist in two fairly popular alternative browsers for Android – Dolphin and Mercury — that depending on the browser could result in either remote code execution or arbitrary read/write access. Mobile security researcher Benjamin Watson, who blogs under the guise of Rotlogix...

China Telecom's Wing Pay App Has Multiple Vulnerabilities

Wing Pay is the business brand of China Telecom that operates payment and internet finance. Wing Pay APP 3.9.6 has multiple security vulnerabilities, including: global file read/write vulnerability; configuration file read/write vulnerability; trust arbitrary security certificate vulnerability;...

CVE-2015-1275: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alertdocument.cookie;// substring, aka...

SUSE SLED11 Security Update : lcms2 (SUSE-SU-2013:1250-1)

lcms2 has been updated to the version 2.5 which is a maintenance release to fix various security and other bugs. - User defined parametric curves can now be saved in ICC profiles. - RGB profiles using same tone curves for several channels are storing now only one copy of the curve - update black...

X (Formerly Twitter): XSS in original referrer after follow

Hey hi, There is a XSS in the intent functionality , Steps to reproduce ======================= 1 copy paste the following Link https://twitter.com/intent/favorite/complete?tweetid=572435913768366080&alreadyfavorited=false&originalreferer=javascript:alert%281%29; 2 Click follow 3 now click return...

Google Chrome Denial of Service Vulnerability (CNVD-2015-00819)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the components/navigationinterception/interceptnavigationresourcethrottle.cc file in versions of Google Chrome prior to 40.0.2214.91, which stems from the program's failure to restri...

Design/Logic Flaw

components/navigationinterception/interceptnavigationresourcethrottle.cc in Google Chrome before 40.0.2214.91 on Android does not properly restrict use of intent: URLs to open an application after navigation to a web site, which allows remote attackers to cause a denial of service loss of browser...

X (Formerly Twitter): twitter android app Fragment Injection

com.twitter.android.WidgetSettingsActivity extend PreferenceActivity and export. By entering the appropriate extra intent can call any of its internal fragment. So do not export com.twitter.android.WidgetSettingsActivity...