Design/Logic Flaw

The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.31 that allows any app co-located on the device to programmatically...

Input validation

The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.11. This app contains an exported service...

Design/Logic Flaw

The Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88lite/iris88lite:8.1.0/O11019/1536323070:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the devic...

Design/Logic Flaw

The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/1536680131:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the device to programmaticall...

Input validation

The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.0.8. This app contains an exported service named...

CVE-2019-15387

The Archos Core 101 Android device with a build fingerprint of archos/MTKAC101CR3GARCHOS/ac101cr3g:7.0/NRD90M/20180611.034442:user/release-keys contains a pre-installed app with a package name of com.roco.autogen app versionCode=1, versionName=1 that allows any app co-located on the device to...

CVE-2019-15387

Summary: CVE-2019-15387 affects the Archos Core 101 Android device with build fingerprint archos/MTKAC101CR3G_ARCHOS/ac101cr3g:7.0/NRD90M/20180611.034442:user/release-keys. A pre-installed app with package name com.roco.autogen (versionCode=1, versionName=1) exposes an interface that allows any c...

CVE-2019-15340

The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakuraindia/sakuraindia:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201805292006 that allows any app...

CVE-2019-15340

The CVE-2019-15340 entry concerns Xiaomi Redmi 6 Pro devices running Android 8.1.0 with a pre-installed app (package com.huaqin.factory app, versionCode=1, versionName=QL1715_201805292006). The app exposes an interface that lets any co-located app disable/enable Wi‑Fi, Bluetooth, and GPS without ...

CVE-2019-15339

The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/1530331229:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the device to programmaticall...

CVE-2019-15339

The CVE-2019-15339 entry applies to the Lava Z60s Android device, where a pre-installed app (package: com.android.lava.powersave, versionCode=400, versionName=v4.0.27) exposes an interface that lets any co-located app programmatically disable and enable Wi‑Fi without the required access permissio...

CVE-2019-15338

The Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88lite/iris88lite:8.1.0/O11019/1536323070:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the devic...

CVE-2019-15338

The CVE-2019-15338 entry concerns Lava Iris 88 Lite (build fingerprint LAVA/iris88_lite/iris88_lite:8.1.0/O11019/1536323070:user/release-keys}). A pre-installed app with package name com.android.lava.powersave (versionCode 400, versionName v4.0.27) exposes an interface that lets any co-located ap...

CVE-2019-15337

The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/1532317309:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.31 that allows any app co-located on the device to programmatically...

CVE-2019-15337

The CVE-2019-15337 entry affects Lava Z81 devices running Android, due to a pre-installed app with package name com.android.lava.powersave (versionCode 400, versionName v4.0.31) that exposes an interface allowing any co-located app to programmatically disable and enable Wi‑Fi without the necessar...

CVE-2019-15336

The Lava Z61 Turbo Android device with a build fingerprint of LAVA/Z61Turbo/Z61Turbo:8.1.0/O11019/1536917928:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.31 that allows any app co-located on the device to...

CVE-2019-15336

CVE-2019-15336 describes a local vulnerability in Lava Z61 Turbo where a pre-installed app (com.android.lava.powersave, versionCode 400, versionName v4.0.31) exposes an exported interface that lets any co-located app disable/enable Wi‑Fi without the required permission. This affects Lava Z61 Turb...

CVE-2019-15335

The Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/1535088037:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the device to programmatically...

CVE-2019-15335

The CVE-2019-15335 entry concerns Lava Z92 Android devices where a pre-installed app (com.android.lava.powersave, versionCode 400, versionName v4.0.27) exposes an interface that lets any co-located app disable/enable Wi‑Fi without the necessary access permission. This is due to an exported interf...

CVE-2019-15334

The Lava Iris 88 Go Android device with a build fingerprint of LAVA/iris88go/iris88go:8.1.0/O11019/1538188945:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app versionCode=400, versionName=v4.0.27 that allows any app co-located on the device to...