CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
Domoticz 4.10717 has XSS via item.Name.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none.
Status Board 1.1.81 has reflected XSS via dashboard.ts.
Status Board 1.1.81 has reflected XSS via logic.ts.
Jooby before 1.6.4 has XSS via the default error handler.
Former before 4.2.1 has XSS via a checkbox value.
M365_firmware, M365, Mi_5s_plus_firmware, Mi_5s_plus, Redmi_6_firmware, Redmi_6, Redmi_5_firmware, Redmi_5, 5s_plus_firmware, 5s_plus
2019-11-19
N/A
5.5 MEDIUM
The Xiaomi Mi A3 Android device with a build fingerprint of xiaomi/onc_eea/onc:9/PKQ1.181021.001/V10.2.8.0.PFLEUXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
M365_firmware, M365, Mi_5s_plus_firmware, Mi_5s_plus, Redmi_6_firmware, Redmi_6, Redmi_5_firmware, Redmi_5, 5s_plus_firmware, 5s_plus
2019-11-19
N/A
5.5 MEDIUM
The Xiaomi Cepheus Android device with a build fingerprint of Xiaomi/cepheus/cepheus:9/PKQ1.181121.001/V10.2.6.0.PFAMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
M365_firmware, M365, Mi_5s_plus_firmware, Mi_5s_plus, Redmi_6_firmware, Redmi_6, Redmi_5_firmware, Redmi_5, 5s_plus_firmware, 5s_plus
2019-11-19
N/A
5.5 MEDIUM
The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/jasmine/jasmine_sprout:9/PKQ1.180904.001/V10.0.2.0.PDIMIFJ:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
M365_firmware, M365, Mi_5s_plus_firmware, Mi_5s_plus, Redmi_6_firmware, Redmi_6, Redmi_5_firmware, Redmi_5, 5s_plus_firmware, 5s_plus
2019-11-20
N/A
5.5 MEDIUM
The Xiaomi Mi A2 Lite Android device with a build fingerprint of xiaomi/daisy/daisy_sprout:9/PKQ1.180917.001/V10.0.3.0.PDLMIXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.