Fallos del tipo CWE-926

119 resultados

Exportação inadequada de componentes Android

Componentes do app Android (Activities, Services, Broadcast Receivers, Content Providers) são expostos publicamente sem autenticação ou permissões adequadas quando marcados como exportados. Isso permite que apps maliciosos ou terceiros não autorizados invoquem diretamente esses componentes, contornando a lógica de segurança da aplicação.

Ejemplo

Um app bancário exporta uma Activity de confirmação de transação sem proteção. Um malware consegue iniciar essa Activity diretamente, simulando transferências ou acessando dados sensíveis sem passar pela tela de login.

Cómo mitigar

Exporte apenas componentes verdadeiramente necessários (evite android:exported=true no AndroidManifest.xml). Para componentes exportados, implemente verificação de permissões (android:permission), validação de intent e use assinaturas de app para restringir quem pode invocar.

CVE-2026-113385MEDIUMLeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application componentsEPSS 0.1%CVE-2026-20516MEDIUMIn MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with UsEPSS 0.1%CVE-2026-21108MEDIUMImproper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive inforEPSS 0.1%CVE-2026-21081MEDIUMImproper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitivEPSS 0.1%CVE-2021-25397MEDIUMAn improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of tEPSS 0.1%CVE-2026-21059MEDIUMImproper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file EPSS 0.1%CVE-2026-107036MEDIUMInsecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exported component, impaEPSS 0.1%CVE-2026-21113MEDIUMImproper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wiEPSS 0.1%CVE-2026-21127MEDIUMImproper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive dEPSS 0.1%CVE-2023-44121MEDIUMLG ThinQ Service - Intent redirection with system privilege/LaunchAnyWhereEPSS 0.1%CVE-2022-24929MEDIUMUnprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.EPSS 0.1%CVE-2023-44129LOWMessaging - Gaining access to arbitrary content providers via QClipIntentReceiverActivityEPSS 0.1%CVE-2026-44279MEDIUMAn improper export of android application components vulnerability in Fortinet FortiTokenAndroid 6.2 all versions, FortiTokenAndroid 6.1 allEPSS 0.1%CVE-2026-3291MEDIUMSamsung Print Service Plugin – Potential Information DisclosureEPSS 0.1%CVE-2021-25388HIGHImproper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app.EPSS 0.1%CVE-2026-45528HIGHIn getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. ThisEPSS 0.1%CVE-2023-20962MEDIUMIn getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to EPSS 0.1%CVE-2025-32347HIGHIn onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. TEPSS 0.1%CVE-2026-54376HIGHVitaFit Android < 2.8.1.0 Custom URI Scheme Token HijackingEPSS —