CWE-926
Improper Export of Android Application Components
Description
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (98)
page 5 of 5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-41829 | Med | 0.33 | 5.0 | 0.00 | Mar 4, 2024 | An improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application to read files without authorization. | ||
| CVE-2023-41827 | Med | 0.33 | 5.1 | 0.00 | Mar 4, 2024 | An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI. | ||
| CVE-2023-44121 | Med | 0.33 | 5.0 | 0.00 | Sep 27, 2023 | The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action… | ||
| CVE-2023-41822 | Med | 0.31 | 4.8 | 0.00 | May 3, 2024 | An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands. | ||
| CVE-2023-41823 | Med | 0.29 | 4.4 | 0.00 | May 3, 2024 | An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activities. | ||
| CVE-2024-6051 | Med | 0.28 | — | 0.00 | Sep 30, 2024 | Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate the view of a vulnerable application.This issue affects Redlink SDK versions through 1.13. | ||
| CVE-2021-4438 | Med | 0.27 | 5.3 | 0.00 | Apr 7, 2024 | A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentMo… | ||
| CVE-2022-24929 | Med | 0.27 | 4.1 | 0.00 | Mar 10, 2022 | Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication. | ||
| CVE-2021-25526 | Med | 0.26 | 4.0 | 0.00 | Dec 8, 2021 | Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action. | ||
| CVE-2021-25391 | Med | 0.26 | 4.0 | 0.00 | Jun 11, 2021 | Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. | ||
| CVE-2021-25390 | Med | 0.26 | 4.0 | 0.00 | Jun 11, 2021 | Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. | ||
| CVE-2021-25379 | Med | 0.26 | 4.0 | 0.00 | Apr 9, 2021 | Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action. | ||
| CVE-2021-25527 | Low | 0.25 | 3.8 | 0.00 | Dec 8, 2021 | Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication. | ||
| CVE-2023-44129 | Low | 0.23 | 3.6 | 0.00 | Sep 27, 2023 | The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity… | ||
| CVE-2024-3479 | Low | 0.18 | 2.8 | 0.00 | May 3, 2024 | An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProvider) that could allow a local attacker to read local data. | ||
| CVE-2024-27086 | Low | 0.18 | 3.9 | 0.00 | Apr 16, 2024 | The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application… | ||
| CVE-2026-86701 | Low | 0.16 | 2.5 | 0.00 | Sep 15, 2026 | Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious… | ||
| CVE-2026-57848 | Med | 0.00 | 5.5 | 0.00 | Jul 18, 2026 | Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does… |
- risk 0.33cvss 5.0epss 0.00
An improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application to read files without authorization.
- risk 0.33cvss 5.1epss 0.00
An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI.
- risk 0.33cvss 5.0epss 0.00
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device by sending a broadcast with the action…
- risk 0.31cvss 4.8epss 0.00
An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands.
- risk 0.29cvss 4.4epss 0.00
An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activities.
- risk 0.28cvss —epss 0.00
Cross Application Scripting vulnerability in Vercom S.A. Redlink SDK in specific situations allows local code injection and to manipulate the view of a vulnerable application.This issue affects Redlink SDK versions through 1.13.
- risk 0.27cvss 5.3epss 0.00
A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentMo…
- risk 0.27cvss 4.1epss 0.00
Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.
- risk 0.26cvss 4.0epss 0.00
Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action.
- risk 0.26cvss 4.0epss 0.00
Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
- risk 0.26cvss 4.0epss 0.00
Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
- risk 0.26cvss 4.0epss 0.00
Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.
- risk 0.25cvss 3.8epss 0.00
Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication.
- risk 0.23cvss 3.6epss 0.00
The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity…
- risk 0.18cvss 2.8epss 0.00
An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProvider) that could allow a local attacker to read local data.
- risk 0.18cvss 3.9epss 0.00
The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity vulnerability. A malicious application…
- risk 0.16cvss 2.5epss 0.00
Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious…
- risk 0.00cvss 5.5epss 0.00
Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does…