CWE-926: Improper Export of Android Application Components, page 3
Filter
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
What the weakness is: CWE-926 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures
Ask an AI about CWE-926
Show the prompt
Explain CWE-926: Improper Export of Android Application Components and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/926.html and https://cve.bz/cve/cwe/926?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 3.9CVE-2024-27086EPSS 0.2%
The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET Android (e.g., MAUI) using the library from versions 4.48.0 to 4.60.0 are impacted by a low severity v…
- 5.3CVE-2021-4438EPSS 0.3%
A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/r…
- 5.0CVE-2023-41829EPSS 0.2%
An improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application to read files without authorization.
- 5.1CVE-2023-41827EPSS 0.2%
An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI.
- 3.3CVE-2023-41960EPSS 0.2%
The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application i…
- 3.3CVE-2023-44129EPSS 0.1%
The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this …
- 6.3CVE-2023-44121EPSS 0.1%
The vulnerability is an intent redirection in LG ThinQ Service ("com.lge.lms2") in the "com/lge/lms/things/ui/notification/NotificationManager.java" file. This vulnerability could be exploited by a third-party app installed on an LG device…
- 4.6CVE-2023-21486EPSS 0.2%
Improper export of android application components vulnerability in ImagePreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.
- 4.6CVE-2023-21485EPSS 0.2%
Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.
- 5.5CVE-2023-20962EPSS 0.09%
In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to an unsafe PendingIntent. This could lead to local information disclosure with no additional executi…
- 3.3CVE-2022-24929EPSS 0.1%
Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.
- 3.3CVE-2021-25527EPSS 0.2%
Improper export of Android application components vulnerability in Samsung Pay (India only) prior to version 4.1.77 allows attacker to access Bill Pay and Recharge menu without authentication.
- 5.5CVE-2021-25526EPSS 0.2%
Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privileged action.
- 7.8CVE-2021-25400EPSS 0.2%
Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action.
- 5.5CVE-2021-25397EPSS 0.1%
An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of telephony process via untrusted applications.
- 4.0CVE-2021-25391EPSS 0.2%
Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
- 4.0CVE-2021-25390EPSS 0.2%
Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.
- 7.1CVE-2021-25388EPSS 0.09%
Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.
- 3.3CVE-2021-25379EPSS 0.2%
Intent redirection vulnerability in Gallery prior to version 5.4.16.1 allows attacker to execute privileged action.