Fallos del tipo CWE-926

119 resultados

Exportação inadequada de componentes Android

Componentes do app Android (Activities, Services, Broadcast Receivers, Content Providers) são expostos publicamente sem autenticação ou permissões adequadas quando marcados como exportados. Isso permite que apps maliciosos ou terceiros não autorizados invoquem diretamente esses componentes, contornando a lógica de segurança da aplicação.

Ejemplo

Um app bancário exporta uma Activity de confirmação de transação sem proteção. Um malware consegue iniciar essa Activity diretamente, simulando transferências ou acessando dados sensíveis sem passar pela tela de login.

Cómo mitigar

Exporte apenas componentes verdadeiramente necessários (evite android:exported=true no AndroidManifest.xml). Para componentes exportados, implemente verificação de permissões (android:permission), validação de intent e use assinaturas de app para restringir quem pode invocar.

CVE-2026-107048CRITICALAn issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via EPSS 0.5%CVE-2025-15464HIGHKL-001-2026-01: yintibao Fun Print Mobile Unauthorized Access via Context HijackingEPSS 0.5%CVE-2026-107032CRITICALInsecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, lEPSS 0.5%CVE-2026-107041HIGHInsecure permissions in the FeatureActionActivity component of Oasis Feng Island versionCode 51801 allows unauthorized attackers to arbitrarEPSS 0.4%CVE-2026-107057CRITICALAn issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.EPSS 0.4%CVE-2025-7891MEDIUMInstantBits Web Video Cast App com.instantbits.cast.webvideo AndroidManifest.xml improper export of android application componentsEPSS 0.4%CVE-2025-27599MEDIUMElement X Android vulnerable to loading malicious web pages via received intentEPSS 0.4%CVE-2026-107038CRITICALInsecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leadingEPSS 0.4%CVE-2025-7890MEDIUMDunamu StockPlus App com.dunamu.stockplus AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7892MEDIUMIDnow App de.idnow AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2025-7893MEDIUMForesight News App pro.foresightnews.appa AndroidManifest.xml improper export of android application componentsEPSS 0.3%CVE-2026-107021CRITICALInsecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackerEPSS 0.3%CVE-2026-107030HIGHInsecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (OEPSS 0.3%CVE-2026-107027CRITICALInsecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading EPSS 0.3%CVE-2026-107040CRITICALInsecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitraEPSS 0.3%CVE-2026-107059HIGHAn issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker contEPSS 0.3%CVE-2026-107019HIGHInsecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to creEPSS 0.3%CVE-2026-107025HIGHInsecure permissions in WikiAndPad alpha/beta v0.2alpha03 (versionCode 200300) allows unauthorized attackers to export the application's datEPSS 0.3%CVE-2026-107014CRITICALInsecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user'EPSS 0.3%CVE-2026-107043CRITICALInsecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechaEPSS 0.3%