86 matches found
CVE-2020-9530
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetAppscom.xiaomi.mipicks mishandles the functionality of opening other components. Attackers need to induce users to open specific web pages in a specific network environment. By jumping to the WebView...
CVE-2020-9530: Improper Control of Generation of Code
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetAppscom.xiaomi.mipicks mishandles the functionality of opening other components. Attackers need to induce users to open specific web pages in a specific network environment. By jumping to the WebView...
CVE-2020-9531: Undefined Security Weakness
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetAppscom.xiaomi.mipicks, the parameters passed in are read and executed. After reading the resource files, relevant components open the link of the incoming URL. Although the URL is safe and can pass...
CVE-2019-13322
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within t...
Authentication flaw
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials partially. This occurs because of paste acces...
CVE-2019-11015
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials partially. This occurs because of paste acces...
CVE-2019-11015
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials partially. This occurs because of paste acces...
CVE-2019-11015
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials partially. This occurs because of paste acces...
CVE-2019-11015
CVE-2019-11015 affects MIUI OS 10.1.3.0, where the Wallpaper Carousel app can enable a physically proximate attacker to bypass lockscreen authentication and access clipboard data and partial stored credentials. The underlying issue is paste access to a social-media login page. CVSS details indica...
CVE-2019-11015: Improper Authentication
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials partially. This occurs because of paste acces...
Xiaomi Mi Browser / Mint Browser URL Spoofing
Exploit Title: URL Spoofing Exploit for Xiaomi Mi Browser v10.5.6-g and Mint Browser v1.5.3 Date : 11/04/2019 Exploit Author: Arif Khan @payloadartist Vendor Homepage: www.xiaomi.com Version : v10.5.6-g and v1.5.3 Tested On : MIUI OS, v10.1.3.0 CVE : CVE-2019-10875 Exploit:...
Spoofing
A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g aka the MIUI native browser and Mint Browser 1.5.3 due to the way they handle the "q" query parameter. The portion of an https URL before the ?q= substring is not shown to the user...
CVE-2019-10875
CVE-2019-10875 is a URL-spoofing vulnerability in Xiaomi Mi Browser (international) 10.5.6-g and Mint Browser 1.5.3 caused by how the q parameter is handled: the portion of the https URL before ?q= is not displayed, enabling spoofing of the address bar. Several public sources document a PoC and p...
Millet user Be careful a system vulnerability has been hacker caught-vulnerability warning-the black bar safety net
You use the Xiaomi mobile phone? You the MIUI system is a 7. 2 The stable version before the system? If Yes, then congratulations you won the lottery. Your phone will likely be hack via a remote code execution vulnerability in the control. ! Millet user Be careful a system vulnerability has been...
Warning: Millions of Xiaomi Phones Vulnerable to Remote Hacking
Millions of Xiaomi smartphones are vulnerable to a dangerous remote code execution RCE vulnerability that could grant attackers complete control of handsets. The vulnerability, now patched, exists in MIUI – Xiaomi's own implementation of the Android operating system – in versions prior to MIUI...
miui-hd2.net-fx2.de XSS vulnerability
Vulnerable URL: http://miui-hd2.net-fx2.de/wp-content/plugins/js-multihotel/includes/refreshDate.php?roomid=%3C/script/%22--%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability...
xiaomi-miui.gr XSS vulnerability
Vulnerable URL: https://xiaomi-miui.gr/community/wcf/js/3rdParty/mejs/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 18328...
MIUI Dark Digital Weather CL. - Dynamic Code Loading, External URLs, SD-card access vulnerabilities
HackApp vulnerability scanner discovered that application MIUI Dark Digital Weather CL. published at the 'play' market has multiple vulnerabilities...
MIUI Digital Weather Clock - Dynamic Code Loading, External URLs, SD-card access vulnerabilities
HackApp vulnerability scanner discovered that application MIUI Digital Weather Clock published at the 'play' market has multiple vulnerabilities...
