Fallos del tipo CWE-926

98 resultados

Exportação inadequada de componentes Android

Componentes do app Android (Activities, Services, Broadcast Receivers, Content Providers) são expostos publicamente sem autenticação ou permissões adequadas quando marcados como exportados. Isso permite que apps maliciosos ou terceiros não autorizados invoquem diretamente esses componentes, contornando a lógica de segurança da aplicação.

Ejemplo

Um app bancário exporta uma Activity de confirmação de transação sem proteção. Um malware consegue iniciar essa Activity diretamente, simulando transferências ou acessando dados sensíveis sem passar pela tela de login.

Cómo mitigar

Exporte apenas componentes verdadeiramente necessários (evite android:exported=true no AndroidManifest.xml). Para componentes exportados, implemente verificação de permissões (android:permission), validação de intent e use assinaturas de app para restringir quem pode invocar.

CVE-2026-44965MEDIUMIn versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (IncidentWidgetActivity, MonitorEPSS 0.1%CVE-2026-21108MEDIUMImproper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive inforEPSS 0.1%CVE-2026-18604MEDIUMtextPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application componentsEPSS 0.1%CVE-2023-44121MEDIUMLG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhereEPSS 0.1%CVE-2022-24929MEDIUMUnprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.EPSS 0.1%CVE-2026-18994HIGHA potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in theEPSS 0.1%CVE-2026-44279MEDIUMAn improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allEPSS 0.1%CVE-2026-86701LOWAndroid application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious appliEPSS 0.1%CVE-2026-3291MEDIUMSamsung Print Service Plugin – Potential Information DisclosureEPSS 0.1%CVE-2023-44129LOWMessaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivityEPSS 0.1%CVE-2026-20516MEDIUMIn MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with UsEPSS 0.1%CVE-2026-21059MEDIUMImproper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file EPSS 0.1%CVE-2026-21113MEDIUMImproper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wiEPSS 0.1%CVE-2026-21081MEDIUMImproper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivEPSS 0.1%CVE-2021-25388HIGHImproper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.EPSS 0.1%CVE-2023-20962MEDIUMIn getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to EPSS 0.1%CVE-2025-32347HIGHIn onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. TEPSS 0.1%CVE-2026-45528HIGHIn getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. ThisEPSS 0.1%