CWE-927 Use of Implicit Intent for Sensitive Communication
variantThe Android application uses an implicit intent for transmitting sensitive data to other applications.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (31)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-47889US | high7.8 | Exploit | ||
The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. These exposed actions can allow any app on… | ||||
| CVE-2022-24300US | critical9.8 | — | ||
Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection. | ||||
| CVE-2020-13909US | critical9.8 | — | ||
The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a conseque… | ||||
| CVE-2022-4903US | high8.1 | — | ||
A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensit… | ||||
| CVE-2023-44122US | high7.8 | — | ||
The vulnerability is to theft of arbitrary files with system privilege in the LockScreenSettings ("com.lge.lockscreensettings") app in the "com/lge/lockscreensettings/dynamicwallpa… | ||||
| CVE-2012-2966US | high7.5 | — | ||
Caucho Quercus, as distributed in Resin before 4.0.29, overwrites entries in the SERVER superglobal array on the basis of POST parameters, which has unspecified impact and remote a… | ||||
| CVE-2006-4433US | high7.5 | — | ||
PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote… | ||||
| CVE-2019-25057US | high7.5 | — | ||
In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer. | ||||
| CVE-2023-31014US | medium4.8 | Exploit | ||
NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implicit intent meant for t… | ||||
| CVE-2006-0012US | medium5.1 | — | ||
Unspecified vulnerability in Windows Explorer in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 allows remote attackers to execute arbitrary code via attack vector… | ||||
| CVE-2025-21024US | medium5.5 | — | ||
Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information. | ||||
| CVE-2024-20899US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2024-20898US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2024-20897US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2024-20896US | medium5.5 | — | ||
Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get sensitive information. | ||||
| CVE-2023-44127US | medium5.5 | — | ||
he vulnerability is that the Call management ("com.android.server.telecom") app patched by LG launches implicit intents that disclose sensitive data to all third-party apps install… | ||||
| CVE-2023-29725US | medium5.5 | — | ||
The BT21 x BTS Wallpaper app 12 for Android allows unauthorized applications to actively request permission to insert data into the database that records information about a user's… | ||||
| CVE-2022-36830US | medium5.5 | — | ||
PendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent… | ||||
| CVE-2022-36829US | medium5.5 | — | ||
PendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files without permission via implicit intent. | ||||
| CVE-2022-33734US | medium5.5 | — | ||
Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission. | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan