CVE-2017-15309

Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulnerability to store downloaded malicious files in an arbitrary directory...

CVE-2017-15310

Huawei iReader app before 8.0.2.301 has an arbitrary file deletion vulnerability due to the lack of input validation. An attacker can exploit this vulnerability to delete specific files from the SD card...

CVE-2017-15310

Huawei iReader app before 8.0.2.301 contains an arbitrary file deletion vulnerability caused by insufficient input validation, allowing an attacker to delete specific files on the SD card. Connected sources confirm this CVE (CVE-2017-15310) is part of a triple vulnerability set in Huawei’s iReade...

CVE-2017-15309

CVE-2017-15309 corresponds to a path traversal vulnerability in Huawei iReader (pre-8.0.2.301). The issue arises from insufficient validation of file storage paths, allowing an attacker to store downloaded malicious files in arbitrary directories. ZDI advisories confirm local exploitation vectors...

CVE-2017-15308

CVE-2017-15308 concerns the Huawei iReader app prior to 8.0.2.301, with an input-validation vulnerability on the URL used to load network data. The issue allows an attacker to control app access and load malicious websites, causing the code in loaded webpages to run. The CVE is confirmed in Huawe...

CVE-2017-15308

Huawei iReader app before 8.0.2.301 has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker can control app access and load malicious websites created by the attacker, and the code in webpages would be loaded and run...

Security Advisory - Multiple Security Vulnerabilities in Huawei iReader

Huawei iReader app has three security vulnerabilities. The app has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker can control app access and load malicious websites created by the attacker, and the code in webpages would be...