39 matches found
CVE-2018-14996
The Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys contains a pre-installed platform app with a package name of com.dropboxchmod versionCode=1, versionName=1.0 that contains an exported service named...
CVE-2018-14994
CVE-2018-14994 affects the Essential Phone on Android 8.1.0 where a pre-installed platform app (package: com.ts.android.hiddenmenu) exposes an activity (com.ts.android.hiddenmenu.rtn.RTNResetActivity) that can initiate a factory reset from any co-located app without permissions. This could lead t...
CVE-2018-14993
The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZWASUSA009/ASUSA009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the Asus ZenFone 3 Max Android device with a build fingerprint of...
CVE-2018-15007
The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069trxl601sky/x6069trxl601sky:6.0/MRA58K/1482897127:user/release-keys contains a pre-installed platform app with a package name of com.fw.upgrade.sysoper versionCode=238, versionName=2.3.8 that contains an exported broadcast...
CVE-2018-15005
The ZTE ZMAX Champ Android device with a build fingerprint of ZTE/Z917VL/fortune:6.0.1/MMB29M/20170327.120922:user/release-keys contains a pre-installed platform app with a package name of com.zte.zdm.sdm versionCode=31, versionName=V5.0.3 that contains an exported broadcast receiver app componen...
CVE-2018-15004
The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode versionCode=24, versionName=7.0 that contains an exported service app component named...
Input validation
The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069trxl601sky/x6069trxl601sky:6.0/MRA58K/1482897127:user/release-keys contains a pre-installed platform app with a package name of com.fw.upgrade.sysoper versionCode=238, versionName=2.3.8 that contains an exported broadcast...
CVE-2018-15007
The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069trxl601sky/x6069trxl601sky:6.0/MRA58K/1482897127:user/release-keys contains a pre-installed platform app with a package name of com.fw.upgrade.sysoper versionCode=238, versionName=2.3.8 that contains an exported broadcast...
CVE-2018-15005
CVE-2018-15005 concerns the ZTE ZMAX Champ running Android 6.0.1, where a pre-installed platform app (package: com.zte.zdm.sdm, version 5.0.3) contains an exported broadcast receiver (com.zte.zdm.VdmcBroadcastReceiver) that allows any co-located app to trigger a factory reset without permissions....
Google Android - WifiNative::setHotlist Stack Overflow Vulnerability
Exploit for php platform in category web applications Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=958 The following code in frameworks/opt/net/wifi/service/jni/comandroidserverwifiWifiNative.cpp doesn't validate the parameter params.numbssid, and then copies that number of...
Google Chrome Extensions Subsystem Security Bypass Vulnerability (CNVD-2016-01516)
Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the extensions/renderer/resources/platformapp.js file in the Extensions subsystem of Google Chrome prior to version 49.0.2623.75, which stems from the program's failure to correctly...
chromium-browser: WebAPI Bypass
extensions/renderer/resources/platformapp.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app...
CVE-2016-1638
extensions/renderer/resources/platformapp.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app...
CVE-2016-1638
extensions/renderer/resources/platformapp.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app...
CVE-2016-1638
extensions/renderer/resources/platformapp.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app...
UBUNTU-CVE-2016-1638
extensions/renderer/resources/platformapp.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app...
CVE-2016-1638
extensions/renderer/resources/platformapp.js in the Extensions subsystem in Google Chrome before 49.0.2623.75 does not properly restrict use of Web APIs, which allows remote attackers to bypass intended access restrictions via a crafted platform app...
CVE-2016-1638
CVE-2016-1638 affects Google Chrome/Chromium before 49.0.2623.75. The vulnerability is in the extensions/renderer/resources/platform_app.js within the Extensions subsystem, where Web API usage was not properly restricted, allowing a crafted platform app to bypass intended access restrictions. The...
