CVE-2019-15393: Externally Controlled Reference to a Resource in Another Sphere

The Asus ZenFone Live Android device with a build fingerprint of asus/WWPhone/ASUSX00LD3:7.1.1/NMF26F/14.0400.1806.203-20180720:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15426: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi 5S Plus Android device with a build fingerprint of Xiaomi/natrium/natrium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via ...

PT-2019-14157

Name of the Vulnerable Software and Affected Versions Xiaomi Mi Note 2 Android device with a build fingerprint of Xiaomi/scorpio/scorpio:6.0.1/MXB48T/7.1.5:user/release-keys com.miui.powerkeeper app version 4.0.00 Description The issue allows unauthorized wireless settings modification via a...

CVE-2019-15428: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Mi Note 2 Android device with a build fingerprint of Xiaomi/scorpio/scorpio:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification vi...

PT-2019-14195

Name of the Vulnerable Software and Affected Versions Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura india/sakura india:8.1.0/OPM1.171019.019/V10.2.6.0.ODMMIXM:user/release-keys Description The issue concerns a pre-installed app with a package name of com.huaqin.facto...

PT-2019-14150

Name of the Vulnerable Software and Affected Versions Blackview BV7000 Pro version 7.0 Description The issue concerns a pre-installed app with a package name of com.mediatek.factorymode that allows unauthorized modification of wireless settings via a confused deputy attack. This capability can be...

CVE-2019-15424: Externally Controlled Reference to a Resource in Another Sphere

The Doogee BL5000 Android device with a build fingerprint of DOOGEE/BL5000/BL5000:7.0/NRD90M/1497072355:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a...

CVE-2019-15420: Externally Controlled Reference to a Resource in Another Sphere

The Blackview BV9000Pro-F Android device with a build fingerprint of Blackview/BV9000Pro-F/BV9000Pro-F:7.1.1/N4F26M/1514363110:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings...

CVE-2019-15467: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Mi Mix 2S Android device with a build fingerprint of Xiaomi/polaris/polaris:8.0.0/OPR1.170623.032/V9.5.19.0.ODGMIFA:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=A2060201801032053 that allows unauthorized wireles...

CVE-2019-15415: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Redmi 5 Android device with a build fingerprint of xiaomi/vince/vince:7.1.2/N2G47H/V9.5.4.0.NEGMIFA:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1711201803291645 that allows unauthorized wireless settings...

CVE-2019-15423: Externally Controlled Reference to a Resource in Another Sphere

The Bluboo BlubooS1 Android device with a build fingerprint of BLUBOO/BlubooS1/BlubooS1:7.0/NRD90M/1495809471:user/release-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via...

CVE-2019-15425: Externally Controlled Reference to a Resource in Another Sphere

The Kata M4s Android device with a build fingerprint of alps/fullhct675066n/hct675066n:7.0/NRD90M/1495624556:user/test-keys contains a pre-installed app with a package name of com.mediatek.factorymode app versionCode=1, versionName=1 that allows unauthorized wireless settings modification via a...

CVE-2019-15744: Externally Controlled Reference to a Resource in Another Sphere

The Sony Xperia Xperia XZs Android device with a build fingerprint of Sony/keyakisoftbank/keyakisoftbank:7.1.1/TONE3-3.0.0-SOFTBANK-170517-0323/1:user/dev-keys contains a pre-installed app with a package name of jp.softbank.mb.tdrl app versionCode=1413005, versionName=1.3.0 that allows unauthoriz...

PT-2019-14152

Name of the Vulnerable Software and Affected Versions Bluboo Bluboo S1 Android device with a build fingerprint of BLUBOO/Bluboo S1/Bluboo S1:7.0/NRD90M/1495809471:user/release-keys com.mediatek.factorymode app version 1 Description The issue allows unauthorized modification of wireless settings v...

CVE-2019-15427: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Mi Mix Android device with a build fingerprint of Xiaomi/lithium/lithium:6.0.1/MXB48T/7.1.5:user/release-keys contains a pre-installed app with a package name of com.miui.powerkeeper app versionCode=40000, versionName=4.0.00 that allows unauthorized wireless settings modification via a...

CVE-2019-15394: Externally Controlled Reference to a Resource in Another Sphere

The Asus ZenFone 5 Selfie Android device with a build fingerprint of asus/WWPhone/ASUSX017D1:7.1.1/NMF26F/14.0400.1810.061-20181107:user/release-keys contains a pre-installed app with a package name of com.asus.atd.smmitest app versionCode=1, versionName=1 that allows unauthorized wireless settin...

CVE-2019-15468: Externally Controlled Reference to a Resource in Another Sphere

The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisysprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app versionCode=1, versionName=QL1715201812071953 that allows unauthorized wireles...