Fallos del tipo CWE-926

98 resultados

Exportação inadequada de componentes Android

Componentes do app Android (Activities, Services, Broadcast Receivers, Content Providers) são expostos publicamente sem autenticação ou permissões adequadas quando marcados como exportados. Isso permite que apps maliciosos ou terceiros não autorizados invoquem diretamente esses componentes, contornando a lógica de segurança da aplicação.

Ejemplo

Um app bancário exporta uma Activity de confirmação de transação sem proteção. Um malware consegue iniciar essa Activity diretamente, simulando transferências ou acessando dados sensíveis sem passar pela tela de login.

Cómo mitigar

Exporte apenas componentes verdadeiramente necessários (evite android:exported=true no AndroidManifest.xml). Para componentes exportados, implemente verificação de permissões (android:permission), validação de intent e use assinaturas de app para restringir quem pode invocar.

CVE-2026-54318HIGHHome Assistant: Exported BroadcastReceiver allows local apps to spoof device locationEPSS 0.2%CVE-2024-6051MEDIUMCross Application Scripting in Redlink SDKEPSS 0.2%CVE-2023-41827MEDIUMAn improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to injEPSS 0.2%CVE-2021-25391MEDIUMIntent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2026-12960MEDIUMAn Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device toEPSS 0.2%CVE-2023-41823MEDIUM An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unaEPSS 0.2%CVE-2021-25390MEDIUMIntent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action.EPSS 0.2%CVE-2023-41829MEDIUMAn improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application tEPSS 0.2%CVE-2023-41821MEDIUM A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user EPSS 0.1%CVE-2025-20934MEDIUMImproper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilegeEPSS 0.1%CVE-2026-21063MEDIUMImproper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical attackers to bypass app lock fuEPSS 0.1%CVE-2025-10721MEDIUMWebull Investing & Trading App AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2024-3479LOW An improper export vulnerability was reported in the Motorola Enterprise MotoDpms Provider (com.motorola.server.enterprise.MotoDpmsProviderEPSS 0.1%CVE-2025-10716MEDIUMCreality Cloud App com.cxsw.sdprinter AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2025-10717MEDIUMintsig CamScanner App com.intsig.camscanner AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2026-47363MEDIUMIn versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied EPSS 0.1%CVE-2025-10718MEDIUMOoma Office Business Phone App com.ooma.office2 improper export of android application componentsEPSS 0.1%CVE-2025-7940MEDIUMGenshin Albedo Cat House App com.house.auscat AndroidManifest.xml improper export of android application componentsEPSS 0.1%CVE-2023-41822MEDIUM An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local applicatioEPSS 0.1%CVE-2025-5344HIGHExposed AIDL service allowing for tampering of system secure settings in Bluebird kiosk applicationEPSS 0.1%