FLEX 1080 < 1085 Web 1.6.0 - Denial of Service
# Exploit Title: FLEX 1080 < 1085 Web 1.6.0 - Denial of Service
android
android 相关平台内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Bookeen Notea – Directory Traversal
# Exploit Title: Bookeen Notea - Directory Traversal
AWebServer GhostBuilding 18 – Denial of Service (DoS)
# Exploit Title: AWebServer GhostBuilding 18 - Denial of Service (DoS)
Xiaomi browser 10.2.4.g – Browser Search History Disclosure
# Exploit Title: Xiaomi browser 10.2.4.g - Browser Search History Disclosure
ES File Explorer 4.1.9.7.4 – Arbitrary File Read
# Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read
Tasks 9.7.3 – Insecure Permissions
# Exploit Title: Tasks 9.7.3 - Insecure Permissions
Magic Home Pro 1.5.1 – Authentication Bypass
# Exploit Title: Magic Home Pro 1.5.1 - Authentication Bypass
Android – ashmem Readonly Bypasses via remap_file_pages() and ASHMEM_UNPIN
This bug report describes two ways in which an attacker can modify the contents
WeChat – Memory Corruption in CAudioJBM::InputAudioFrameToJBM
There is a memory corruption vulnerability in audio processing during a voice call in WeChat. When an RTP packet is p...
Mersive Solstice 2.8.0 – Remote Code Execution
# Exploit Title: Mersive Solstice 2.8.0 - Remote Code Execution
Whatsapp 2.19.216 – Remote Code Execution
# Exploit Title: Whatsapp 2.19.216 - Remote Code Execution
Android – Binder Driver Use-After-Free
The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm (an...
Canon PRINT 2.5.5 – Information Disclosure
# Exploit Title: Content Provider URI Injection on Canon PRINT 2.5.5
Android 7 < 9 - Remote Code Execution
# Exploit Title: Android 7-9 - Remote Code Execution
Android 7 – 9 VideoPlayer – ‘ihevcd_parse_pps’ Out-of-Bounds Write
CVE-2019-2107 - looks scary. Still remember Stagefright and PNG bugs vulns .... With CVE-2019-2107 the decoder/codec ...
Qualcomm Android – Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL
The following issue exists in the android-msm-wahoo-4.4-pie branch of
EquityPandit 1.0 – Password Disclosure
#Exploit title: EquityPandit v1.0 - Insecure Logging
WeChat for Android 7.0.4 – ‘vcodec2_hls_filter’ Denial of Service
# Exploit Title: DoS Wechat with an emoji
Android – getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass
We already reported four bugs in Android that are caused by the use of
Android – binder Use-After-Free via racy Initialization of ->allow_user_free
The following bug report solely looks at the situation on the upstream master
FTP Server 1.32 – Denial of Service
#!/usr/bin/env python
ScreenStream 3.0.15 – Denial of Service
#!/usr/bin/python
Android Kernel < 4.8 - ptrace seccomp Filter Bypass
The seccomp.2 manpage (http://man7.org/linux/man-pages/man2/seccomp.2.html) documents:
AirMore 1.6.1 – Denial of Service (PoC)
#!/usr/bin/python
ApowerManager 3.1.7 – Phone Manager Remote Denial of Service (PoC)
#!/usr/bin/python
Android – binder Use-After-Free of VMA via race Between reclaim and munmap
The following bug report solely looks at the situation on the upstream master
Android – binder Use-After-Free via fdget() Optimization
This bug report describes *two* different issues in different branches of the
AirDroid 4.2.1.6 – Denial of Service
#!/bin/bash
1Password < 7.0 - Denial of Service
############
WhatsApp – RTP Processing Heap Corruption
Heap corruption can occur when the WhatsApp mobile application receives a malformed RTP packet.
Android – sdcardfs Changes current->fs Without Proper Locking
Tested on a Pixel 2 (walleye):
Android – ‘zygote->init;’ Chain from USB Privilege Escalation
After reporting https://bugs.chromium.org/p/project-zero/issues/detail?id=1583
Android – Directory Traversal over USB via Injection in blkid Output
When a USB mass storage device is inserted into an Android phone (even if the
Ftp Server 1.32 – Credential Disclosure
# Exploit Title: Ftp Server 1.32 - Credential Disclosure
Werewolf Online 0.8.8 – Information Disclosure
# Exploit Title: Werewolf Online 0.8.8 - Insecure Logging
Samsung Galaxy S7 Edge – Overflow in OMACP WbXml String Extension Processing
OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the m...
MakeMyTrip 7.2.4 – Information Disclosure
# Exploit Title: Android Application MakeMyTrip 7.2.4 - Unencrypted Database Files
LineageOS 14.1 Blueborne – Remote Code Execution
# Exploit Title: LineageOS 14.1 (Android 7.1.2) Blueborne RCE CVE-2017-0781
Papenmeier WiFi Baby Monitor Free & Lite < 2.02.2 - Remote Audio Record
Whilst analysing a number of free communication based applications on the Google Play Store, I took a look at WiFi Ba...
Android – ‘getpidcon’ Permission Bypass in KeyStore Service
The keystore binder service ("android.security.IKeystoreService") allows users to issue several commands related to k...
Android – Hardware Service Manager Arbitrary Service Replacement due to getpidcon
This bug is similar to Jann Horn's issue (https://bugs.chromium.org/p/project-zero/issues/detail?id=851) -- credit sh...
Android – Inter-Process munmap due to Race Condition in ashmem
The MemoryIntArray class allows processes to share an in-memory array of integers backed by an "ashmem" file descript...