Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
246 results · page 3 of 5
Feb 28, 2025An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario HealCVE-2025-20060 · Other software · Dario Health · reported by ics-cert@hq.dhs.govHigh 8.7
An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Health application database.
- Product
- USB-C Blood Glucose Monitoring System Starter Kit Android Applications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govdariohealth.com
Feb 26, 2025SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation.CVE-2024-50691 · Other software · Sungrowpower · reported by MITREHigh 7.4
SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is vulnerable to MiTM attacks. Attackers can impersonate the iSolarCloud server and communicate with the Android app.
- Product
- Isolarcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials.CVE-2024-50688 · Other software · Sungrowpower · reported by MITRECritical 9.8
SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT credentials for exchanging the device telemetry.
- Product
- Isolarcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy).CVE-2024-50684 · Other software · Sungrowpower · reported by MITREMedium 6.5
SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud.
- Product
- Isolarcloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory and save it into pubCVE-2024-44336 · Other software · reported by MITREMedium 5.3
An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory and save it into publicly available storage.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2025Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.CVE-2025-20906 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper Export of Android Application Components in Settings prior to SMR Feb-2025 Release 1 allows local attackers to enable ADB.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Feb 3, 2025Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.CVE-2024-34897 · Other software · reported by MITREHigh 7.5
Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database.CVE-2024-12094 · Other software · Mogify Infotech · reported by vdisclose@cert-in.org.inMedium 5.4
This vulnerability exists in the Tinxy mobile app due to storage of logged-in user information in plaintext on the device database. An attacker with physical access to the rooted device could exploit this vulnerability by accessing its database leading to unauthorized access of user information such as username, email address and mobile number. Note: To exploit this vulnerability, the device must be rooted/jailbroken.
- Product
- Tinxy Android app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprinCVE-2024-40240 · Other software · homeserveusa · reported by MITREMedium 6.8
An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
- Product
- homeserve
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapkpure.comzzzxiin.github.io
Nov 8, 2024An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fingCVE-2024-40239 · Other software · hitbytestechnologies · reported by MITREMedium 6.8
An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.
- Product
- life
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplay.google.comzzzxiin.github.io
Oct 30, 2024The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone calls without user inteCVE-2024-37573 · Other software · talkatone · reported by MITREHigh 8.4
The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.talkatone.vedroid.ui.launcher.OutgoingCallInterceptor component.
- Product
- talkatone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password.CVE-2024-42496 · Other software · TECHNO SUPPORT COMPANY · reported by vultures@jpcert.or.jpLow 2.4
Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is exploited, an attacker with physical access to the device may retrieve the credential information and spoof the device to access the related external service.
- Product
- Smart-tab Android app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability.CVE-2024-41999 · Other software · TECHNO SUPPORT COMPANY · reported by vultures@jpcert.or.jpMedium 6.8
Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerability is exploited, an attacker with physical access to the device may exploit the debug function to gain access to the OS functions, escalate the privilege, change the device's settings, or spoof devices in other rooms.
- Product
- Smart-tab Android app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege.CVE-2024-34654 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My Files' privilege.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Sep 4, 2024Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuration.CVE-2024-34641 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configuration.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Jul 23, 2024EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.CVE-2024-7014 · Computers, phones & browsers · Android · reported by security@eset.comHigh 7.1
EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.
- Product
- Telegram for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwelivesecurity.comwelivesecurity.com
Jun 24, 2024udn News Android APP stores the unencrypted user session in the local database when user log into the application.CVE-2024-6295 · Other software · udn · reported by twcert@cert.org.twLow 3.9
udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.
- Product
- udn News App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jun 24, 2024udn News Android APP stores the user session in logcat file when user log into the APP.CVE-2024-6294 · Other software · udn · reported by twcert@cert.org.twLow 3.9
udn News Android APP stores the user session in logcat file when user log into the APP. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.
- Product
- udn News App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 7, 2024Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device withoCVE-2024-20860 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper export of android application components vulnerability in TelephonyUI prior to SMR May-2024 Release 1 allows local attackers to reboot the device without proper permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 29, 2024ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented.CVE-2024-4303 · Computers, phones & browsers · ArmorX · reported by twcert@cert.org.twHigh 8.8
ArmorX Android APP's multi-factor authentication (MFA) for the login function is not properly implemented. Remote attackers who obtain user credentials can bypass MFA, allowing them to successfully log into the APP.
- Product
- ArmorX APP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 24, 2024NewPipe is an Android app for video streaming written in Java.CVE-2024-32876 · Other software · TeamNewPipe · reported by GitHubHigh 8.5
NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could have resulted in Arbitrary Code Execution. This is because backups are serialized/deserialized using Java's Object Serialization Stream Protocol, which can allow constructing any class in the app, unless properly restricted. To exploit this vulnerability, an attacker would need to build a backup file containing the exploit, and then persuade a user into importing it. During the import process, the malicious code would be executed, possibly crashing the app, stealing user data from the NewPipe app, performing nasty actions through Android APIs, and attempting Android JVM/Sandbox escapes through vulnerabilities in the Android OS. The attack can take place only if the user imports a malicious backup file, so an attacker would need to trick a user into importing a backup file from a source they can control. The implementation details of the malicious backup file can be independent of the attacked user or the devic
- Product
- NewPipe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.oracle.comgithub.com
Mar 18, 2024Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device tCVE-2024-28745 · Other software · AbemaTV, Inc. · reported by vultures@jpcert.or.jpLow 3.3
Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.
- Product
- 'ABEMA' App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2024The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers.CVE-2023-47889 · Other software · Binhdrm26 · reported by MITREHigh 7.8
The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on the device to send unauthorized broadcasts, leading to unintended consequences. The vulnerability is particularly concerning because these actions include powering off, system reboot & entering recovery mode.
- Product
- Super Reboot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2024A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and before allows attackCVE-2023-33757 · Other software · Splicecom · reported by MITREMedium 5.9
A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and before allows attackers to eavesdrop on communications via a man-in-the-middle attack.
- Product
- Ipcs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of priCVE-2023-38411 · Other software · Intel · reported by secure@intel.comLow 3.9
Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Smart Campus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper access control in the Intel Support android application all verions may allow an authenticated user to potentially enable information disclosure via loCVE-2023-33872 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in the Intel Support android application all verions may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverageCVE-2023-45844 · Other software · Rexroth · reported by psirt@bosch.comMedium 6.8
The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android application and leverage it to have access to critical device settings such as the device power management or eventually the device secure settings (ADB debug).
- Product
- ctrlX HMI Web Panel - WR21 (WR2107)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Sep 6, 2023Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to chCVE-2023-30718 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows local attacker to change a Auto Hotspot setting.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Aug 10, 2023Improper access control in the Intel Unite(R) android application before version 4.2.3504 may allow an authenticated user to potentially enable information discCVE-2023-32609 · Other software · Intel · reported by secure@intel.comMedium 5
Improper access control in the Intel Unite(R) android application before version 4.2.3504 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Unite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Incorrect default permissions in the Intel(R) Support android application before version v23.02.07 may allow a privileged user to potentially enable informationCVE-2023-27392 · Other software · Intel · reported by secure@intel.comMedium 4.4
Incorrect default permissions in the Intel(R) Support android application before version v23.02.07 may allow a privileged user to potentially enable information disclosure via local access.
- Product
- Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023 Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application.CVE-2023-32274 · Other software · Enphase · reported by ics-cert@hq.dhs.govHigh 8.6
Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information.
- Product
- Enphase Installer Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities.CVE-2023-25749 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities. Firefox will now confirm with users that they want to launch an external application before doing so. <br>*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
May 10, 2023Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potentiallCVE-2023-25772 · Other software · Intel · reported by secure@intel.comMedium 5
Improper input validation in the Intel(R) Retail Edge Mobile Android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Retail Edge Program
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial ofCVE-2023-25179 · Other software · Intel · reported by secure@intel.comMedium 5
Uncontrolled resource consumption in the Intel(R) Unite(R) android application before Release 17 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Unite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to potentially enable information disclosure CVE-2023-23573 · Other software · Intel · reported by secure@intel.comMedium 4.4
Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to potentially enable information disclosure via local access.
- Product
- Unite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable deniCVE-2022-46645 · Other software · Intel · reported by secure@intel.comMedium 5
Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Smart Campus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable CVE-2022-46279 · Other software · Intel · reported by secure@intel.comMedium 5
Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Retail Edge Program
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denialCVE-2022-41801 · Other software · Intel · reported by secure@intel.comMedium 5
Uncontrolled resource consumption in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Connect M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable escalation of prCVE-2022-41769 · Other software · Intel · reported by secure@intel.comMedium 4.8
Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Connect M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to CVE-2023-21486 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 4, 2023Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to CVE-2023-21485 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 1, 2023A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.CVE-2022-48186 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.2
A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.
- Product
- Baiying
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cniknow.lenovo.com.cn
Apr 11, 2023Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attCVE-2023-22429 · Other software · Wolt · reported by vultures@jpcert.or.jpHigh 7.8
Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attacker to obtain the hard-coded API key via reverse-engineering the application binary.
- Product
- Wolt Delivery: Food and more
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2023Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem.CVE-2023-28646 · Other software · nextcloud · reported by GitHubMedium 4.4
Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enablCVE-2022-41614 · Other software · Intel · reported by secure@intel.comMedium 5.5
Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- ON Event Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023The ownCloud Android app allows ownCloud users to access, share, and edit files and folders.CVE-2023-24804 · Other software · ownCloud · reported by GitHubMedium 5
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal files, and to arbitrary file write when uploading plain text files (although limited by the .txt extension). Version 3.0 fixes the reported bypasses.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comowncloud.com
Feb 13, 2023The ownCloud Android app allows ownCloud users to access, share, and edit files and folders.CVE-2023-23948 · Other software · ownCloud · reported by GitHubMedium 6.2
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in `FileContentProvider.kt`. This issue can lead to information disclosure. Two databases, `filelist` and `owncloud_database`, are affected. In version 3.0, the `filelist` database was deprecated. However, injections affecting `owncloud_database` remain relevant as of version 3.0.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritylab.github.comsecuritylab.github.com
Nov 11, 2022Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable informationCVE-2022-36367 · Other software · Intel · reported by secure@intel.comMedium 4.4
Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable information disclosure via local access.
- Product
- Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable deniCVE-2022-30691 · Other software · Intel · reported by secure@intel.comMedium 5.9
Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Support
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022Insufficient access controls in the AMD Link Android app may potentially result in information disclosure.CVE-2022-27673 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient access controls in the AMD Link Android app may potentially result in information disclosure.
- Product
- AMD Link Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.