ResourcePoison

이 문제에 대한 수정 사항이 CVE-2025-22441로 공개되었습니다: 공지 패치 후속 조치 ApplicationInfo 전달하기 ApplicationInfo는 설치된 앱에 대한 다양한 정보를 정의하는 구조체로, 가장 주목할 만한 것은 리소스와 코드가 로드되는 apk 파일의 경로입니다. 일반적으로 시스템에서 애플리케이션으로 전달되지만, 비시스템 호출자가 자체 객체를 제공할 수 있는 경우도 있습니다. 예를 들어 과거에는 bindBackupAgent 메서드의 취약점이 있었는데, 공격자가 매개변수로 자체 ApplicationInf...

Exploit for Confused Deputy in Google Android

Fix for this issue has appeared as CVE-2025-22441: bulletinht...

EUVD-2025-27073

Malicious code in bioql PyPI...

EUVD-2022-52540

Malicious code in bioql PyPI...

CVE-2025-22441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2025-22441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2025-22441

The Android operating system is vulnerable to a confused deputy flaw in RemoteViews.java within the getContextForResourcesEnsuringCorrectCachedApkPaths method. An attacker can provide an untrusted ApplicationInfo object through RemoteViews (used for home screen widgets , notifications , and autof...

PT-2025-31844

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description The vulnerability relates to insufficient access control within the Framework component of Android operating systems. Exploitation may allow an attacker to elevate their privileges. The issue...

CVE-2023-21286

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21277

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21279

In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2022-30710

Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities...

Google Android elevation of privilege vulnerability (CNVD-2023-69045)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability caused by a lack of privilege checks in visitFrees of RemoteViews.java. An attacker can exploit this vulnerability to gain elevated privileges...

CVE-2023-21286

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21279

In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21277

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21286

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21279

In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21277

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21277

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation...