New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Elastic Cloud Enterprise: Improper link resolution enables cross-deployment file access

Elastic Cloud Enterprise (ECE) 4.1.0 up to and including 4.2.0 contains a link-following flaw (CWE-59) that can allow an attacker to read and modify data of other deployments on the same host via a symlink attack. Exploitation requires local access with high privileges and, per the vendor advisory, code execution inside an Enterprise Search instance container. Deployments without Enterprise Search are not exposed.

Elastic · Elastic Cloud Enterprise

Elastic Elastic Cloud Enterprise

Research and translation in progress – available shortly.

Elastic Elastic Cloud Enterprise

Research and translation in progress – available shortly.

Elastic Cloud Enterprise: Link following leads to information disclosure and data loss

Elastic Cloud Enterprise (ECE) contains a link following flaw (CWE-59) that allows a local attacker to access or destroy data of other deployments on the same host via a symlink attack. Exploitation requires high privileges, such as the ability to run code inside an Elasticsearch deployment container or prior access to the host. Internet-facing exposure is not required, but the risk is highest on shared multi-tenant ECE hosts.

Elastic · Elastic Cloud Enterprise

Elastic Cloud Enterprise: Link following leads to authentication bypass

Elastic Cloud Enterprise (ECE) versions 1.0.0 to 3.8.5 and 4.0.0 to 4.2.0 contain a link-following flaw (CWE-59) that enables a symlink attack on shared allocator hosts. An attacker who can run code inside an Elasticsearch deployment container, for example via custom bundles or plugins, can bypass authentication and change the configuration of other deployments on the same host. Exploitation requires local access and high privileges, and no exploitation has been reported; Elastic rates the issue High (CVSS 7.2).

Elastic · Elastic Cloud Enterprise

Elastic Elastic Cloud Enterprise

Research and translation in progress – available shortly.

Elastic Elastic Cloud Enterprise

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Share 2 Archive Today: Improper component export allows clipboard overwrite

Share 2 Archive Today for Android, versionCode 61, exports a headless activity without permission protection or caller checks. Any app installed on the same device can start it with a crafted URL and silently replace the content of the clipboard. The attacker cannot read the clipboard or run code, and the victim only needs the app installed, but the next paste may then carry attacker-controlled content.

Gnosco · Share 2 Archive Today

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Handy News Reader: Exported activity lets apps make the reader fetch arbitrary URLs

The Android app Handy News Reader (package ru.yanus171.feedexfork, versionCode 116) exports the activity activity.LoadLinkLaterActivity without a permission check. Any app installed on the same device can send it a URL, and the reader then fetches that URL without user interaction. The advisory describes this as unattended victim-side fetching and queue insertion, with no code execution or read-back to the attacker. The CVSS 7.5 score in the input could not be verified; VulDB lists 4.3.

yanus171 · Handy News Reader (FeedEx)

Working Time Account: Exported component allows forged holiday entries

The holiday import component (feiertage.ImportActivity) of the Android app Working Time Account (Arbeitszeiterfassung2) is exported and requires no permissions. A zero-permission app installed on the same device can send crafted ICS data to it, which writes forged holiday entries into the app's work-time database without user interaction. The CVE data lists CVSS 8.8, but the research notes found conflicting scores (VulDB 3.5), so the severity is not yet verified; the impact is limited to integrity of time records.

Askanimus · Working Time Account

Ghost Commander: Improper export of content provider allows file access

Ghost Commander File Manager for Android, versionCode 479, exposes an exported content provider (StreamProvider) without permission checks. A locally installed app without runtime permissions can read and write files in the app's private storage by supplying a file URI. The CVE record rates this as high severity (CVSS 8.1), while the vendor advisory describes a read/write primitive without code execution or privilege escalation.

Ghost Squared · Ghost Commander

Voki Bot: Improper export of ShortcutDispatchActivity allows unauthorized automation replay

Voki Bot for Android (net.canvoki.vokibot) exports the ShortcutDispatchActivity component without a permission check. A malicious app on the same device can start it with a known trigger ID and make Voki Bot execute the user's configured automations, for example launching system settings. The attacker needs no permissions and no user interaction, but the trigger and automation must already exist in the victim's app data.

canvoki · Voki Bot

Research and translation in progress – available shortly.

Simple Contacts Pro: Improper export of content provider exposes private contacts

Simple Contacts Pro versionCode 107 (and according to the advisory also 108) declares an exported content provider without any permission requirement. Any app installed on the same Android device can query it and read private local contacts, including names, phone numbers, birthdays and anniversaries, if the hidden-contacts setting is enabled, which is the default. The provider is read-only, and no code execution or privilege escalation is claimed. The NVD record lists CVSS 9.1 with network attack vector, which does not match the local nature of this flaw described in the advisory.

Simple Mobile Tools · Simple Contacts Pro

Bander Notepad: Exported content provider exposes notes

Bander Notepad (bander.notepad) version code 12 exports its note content provider without a permission requirement. Any app installed on the same Android device, without any permissions, can read existing notes and insert new ones into the victim's note database. The victim app must have been launched once so that its database exists. The CVE record is marked Deferred and the upstream project appears abandoned, so no fix is known.

Bander · Bander Notepad

Research and translation in progress – available shortly.