CWE-927 Use of Implicit Intent for Sensitive Communication
variantThe Android application uses an implicit intent for transmitting sensitive data to other applications.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (31)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-47889US | high7.8 | Exploit | ||
The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on… | ||||
| CVE-2022-24300US | critical9.8 | — | ||
Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection. | ||||
| CVE-2020-13909US | critical9.8 | — | ||
The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a conseque… | ||||
| CVE-2022-4903US | high8.1 | — | ||
A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensit… | ||||
| CVE-2023-44122US | high7.8 | — | ||
The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpa… | ||||
| CVE-2012-2966US | high7.5 | — | ||
Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote a… | ||||
| CVE-2006-4433US | high7.5 | — | ||
PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote… | ||||
| CVE-2019-25057US | high7.5 | — | ||
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer. | ||||
| CVE-2023-31014US | medium4.8 | Exploit | ||
NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implicit intent meant for t… | ||||
| CVE-2006-0012US | medium5.1 | — | ||
Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vector… | ||||
| CVE-2025-21024US | medium5.5 | — | ||
Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information. | ||||
| CVE-2024-20899US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2024-20898US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2024-20897US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2024-20896US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2023-44127US | medium5.5 | — | ||
he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps install… | ||||
| CVE-2023-29725US | medium5.5 | — | ||
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's… | ||||
| CVE-2022-36830US | medium5.5 | — | ||
PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent… | ||||
| CVE-2022-36829US | medium5.5 | — | ||
PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent. | ||||
| CVE-2022-33734US | medium5.5 | — | ||
Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission. | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan