Vulnerabilities

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write a…

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page

A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.

The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed.

An unauthorized access vulnerability exists in the PcSuite APP.

The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability.

Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.

The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The wallet has an authentication bypass vulnerability that allows access to specific pages.

SystemUI has an incorrect component protection setting, which allows access to specific information.

The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.

Some parameters of the alarm clock module are improperly stored, leaking some sensitive information.

Locally installed application can bypass the permission check and perform system operations that require permission.

Some parameters of the weather module are improperly stored, leaking some sensitive information.

The wifi module exposes the interface and has improper permission control, leaking sensitive information about the device.

Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands with root privilege.

When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead t…

The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files

Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.

Improper control of framework service permissions with possibility of some sensitive device information leakage.

The framework service handles pendingIntent incorrectly, allowing a malicious application with certain privileges to perform privileged actions.

The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.

The appstore before 8.12.0.0 exposes some of its components, and the attacker can cause remote download and install apps through carefully constructed parameters.