CWE-925 Improper Verification of Intent by Broadcast Receiver
variantThe Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (10)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2010-1175US | high9.3 | Exploit | ||
Microsoft Internet Explorer 7.0 on Windows XP and Windows Server 2003 allows remote attackers to have an unspecified impact via a certain XML document that references a crafted web… | ||||
| CVE-2012-2450US | high9.0 | — | ||
VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly reg… | ||||
| CVE-2013-5878US | high7.5 | — | ||
Unspecified vulnerability in Oracle Java SE 6u65 and 7u45, Java SE Embedded 7u45, and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via u… | ||||
| CVE-2020-22061US | high7.8 | — | ||
SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. This issue allows attackers to arbitrarily write data to the device via IOCTL 0x9C4… | ||||
| CVE-2021-30696US | medium5.9 | — | ||
An attacker in a privileged network position may be able to misrepresent application state. This issue is fixed in macOS Big Sur 11.4, Security Update 2021-003 Catalina, Security U… | ||||
| CVE-2023-44126US | medium5.5 | — | ||
The vulnerability is that the Call management ("com.android.server.telecom") app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third… | ||||
| CVE-2026-33173US | medium5.3 | — | ||
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary meta… | ||||
| CVE-2013-5768US | medium4.0 | — | ||
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors relate… | ||||
| CVE-2026-21106US | — | — | ||
Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings. | ||||
| CVE-2024-10576US | — | — | ||
Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and forc… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan