vivo

The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions.

An unauthorized access vulnerability exists in the PcSuite APP.

The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The appstore before 8.12.0.0 exposes some of its components, and the attacker can cause remote download and install apps through carefully constructed parameters.

Vivo modems allow remote attackers to obtain sensitive information by reading the index.cgi?page=wifi HTML source code, as demonstrated by ssid and psk_wepkey fields.

The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.

Locally installed application can bypass the permission check and perform system operations that require permission.

Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands with root privilege.

The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability.

When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead t…

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.smartshot (versionCode=1, versionName=3.0.0).

The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.

Some parameters of the weather module are improperly stored, leaking some sensitive information.

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.bsptest (versionCode=1, versionName=1.0) contain…

Some parameters of the alarm clock module are improperly stored, leaking some sensitive information.

The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.

The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which caused out of the boundary when memory access.The vulnerability eventually leads to a local DOS on th…

The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed.

The wallet has an authentication bypass vulnerability that allows access to specific pages.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write a…

Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.

SystemUI has an incorrect component protection setting, which allows access to specific information.

Improper control of framework service permissions with possibility of some sensitive device information leakage.