Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-22072 (GCVE-0-2026-22072)

Vulnerability from nvd – Published: 2026-08-17 06:13 – Updated: 2026-08-17 15:24

Title

Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Summary

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 15:24 UTC

CWE

CWE-20 - Improper input validation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Health	Affected: 6.2.9 (git)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T15:24:21.144626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T15:24:32.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Health",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.9",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
            }
          ],
          "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-639",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-639 Probe System Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T06:13:58.205Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2088198578949595136"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary URL Loading in WebView Leading to Token Leakage Risk",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22072",
    "datePublished": "2026-08-17T06:13:58.205Z",
    "dateReserved": "2026-01-06T06:15:53.764Z",
    "dateUpdated": "2026-08-17T15:24:32.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22078 (GCVE-0-2026-22078)

Vulnerability from nvd – Published: 2026-06-29 08:05 – Updated: 2026-06-29 11:53

Title

O+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.

Summary

Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 11:53 UTC

CWE

CWE-266 - Incorrect privilege assignment

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	O+ Connect	Affected: 16.0.33

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22078",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T11:53:04.056229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T11:53:21.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "O+ Connect",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.33"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Because O+ Connect\u0027s IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel."
            }
          ],
          "value": "Because O+ Connect\u0027s IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect privilege assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T11:52:51.499Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2070415238859333632"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "O+ Connect\u0027s lack of authentication for IPC channels led to a local privilege escalation vulnerability.",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22078",
    "datePublished": "2026-06-29T08:05:49.776Z",
    "dateReserved": "2026-01-06T06:15:53.765Z",
    "dateUpdated": "2026-06-29T11:53:21.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22070 (GCVE-0-2026-22070)

Vulnerability from nvd – Published: 2026-04-30 08:27 – Updated: 2026-04-30 13:01

Title

ColorOS Assistant Path Traversal Vulnerability

Summary

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-30 13:01 UTC

CWE

CWE-23 - Relative path traversal

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	ColorOS Assistant	Unaffected: 1.4.26

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-30T13:01:03.772357Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-30T13:01:16.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ColorOS Assistant",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.26"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal."
            }
          ],
          "value": "ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative path traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-30T08:27:57.043Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2049764240746881024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ColorOS Assistant Path Traversal Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22070",
    "datePublished": "2026-04-30T08:27:57.043Z",
    "dateReserved": "2026-01-06T06:15:53.764Z",
    "dateUpdated": "2026-04-30T13:01:16.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22077 (GCVE-0-2026-22077)

Vulnerability from nvd – Published: 2026-04-27 06:37 – Updated: 2026-04-27 13:29

Title

Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet

Summary

OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.

Severity

5.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-27 13:19 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Wallet APP	Affected: all

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T13:19:04.793103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T13:29:23.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Wallet APP",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure."
            }
          ],
          "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T07:27:33.199Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22077",
    "datePublished": "2026-04-27T06:37:05.647Z",
    "dateReserved": "2026-01-06T06:15:53.765Z",
    "dateUpdated": "2026-04-27T13:29:23.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-27388 (GCVE-0-2025-27388)

Vulnerability from nvd – Published: 2025-08-14 07:15 – Updated: 2025-08-14 19:37

Title

Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Summary

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-14 19:36 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO HEALTH APP	Affected: 4.23.4 and below , ≤ 4.23.4 (git)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T19:36:20.850842Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T19:37:41.298Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO HEALTH APP",
          "vendor": "OPPO",
          "versions": [
            {
              "lessThanOrEqual": "4.23.4",
              "status": "affected",
              "version": "4.23.4 and below",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
            }
          ],
          "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-639",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-639 Probe System Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T07:15:10.875Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1955879800426209280"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary URL Loading in WebView Leading to Token Leakage Risk",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2025-27388",
    "datePublished": "2025-08-14T07:15:10.875Z",
    "dateReserved": "2025-02-24T03:04:32.845Z",
    "dateUpdated": "2025-08-14T19:37:41.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-27387 (GCVE-0-2025-27387)

Vulnerability from nvd – Published: 2025-06-23 09:28 – Updated: 2026-01-06 06:20

Title

OPPO Clone Phone uses weak WPA passphrase as only means of security

Summary

OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-23 12:09 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	ColorOS	Affected: 15.0.2 and below

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-23T12:09:11.626527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-23T12:14:46.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ColorOS",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.2 and below"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure."
            }
          ],
          "value": "OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-112",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-112 Brute Force"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-06T06:20:24.543Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1937080145974403072https://"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Clone Phone uses weak WPA passphrase as only means of security",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2025-27387",
    "datePublished": "2025-06-23T09:28:08.244Z",
    "dateReserved": "2025-02-24T03:04:32.845Z",
    "dateUpdated": "2026-01-06T06:20:24.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-1609 (GCVE-0-2024-1609)

Vulnerability from nvd – Published: 2024-12-25 03:14 – Updated: 2024-12-26 19:52

Title

OPPO Store APP has a WebView component privilege escalation vulnerability.

Summary

In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-26 19:51 UTC

CWE

CWE-287 - Improper Authentication

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPP Store	Affected: 3.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-26T19:51:53.624999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-26T19:52:25.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPP Store",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn OPPOStore iOS App, there\u0027s a possible escalation of privilege due to improper input validation. \u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "In OPPOStore iOS App, there\u0027s a possible escalation of privilege due to improper input validation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-25T03:14:43.216Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Store APP has a WebView component privilege escalation vulnerability.",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2024-1609",
    "datePublished": "2024-12-25T03:14:43.216Z",
    "dateReserved": "2024-02-19T07:48:58.472Z",
    "dateUpdated": "2024-12-26T19:52:25.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1610 (GCVE-0-2024-1610)

Vulnerability from nvd – Published: 2024-12-18 06:18 – Updated: 2024-12-18 15:33

Title

OPPO Store app include remote account token hijacking and sensitive information leakage

Summary

In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-18 15:30 UTC

CWE

CWE-287 - Improper Authentication
CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Store APP	Affected: 4.32.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-1610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-18T15:30:05.310072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1284",
                "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-18T15:33:31.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Store APP",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "4.32.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn OPPO Store APP, there\u0027s a possible escalation of privilege due to improper input validation. \u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "In OPPO Store APP, there\u0027s a possible escalation of privilege due to improper input validation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-18T06:18:48.588Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Store app include remote account token hijacking and sensitive information leakage",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2024-1610",
    "datePublished": "2024-12-18T06:18:48.588Z",
    "dateReserved": "2024-02-19T07:49:02.096Z",
    "dateUpdated": "2024-12-18T15:33:31.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1608 (GCVE-0-2024-1608)

Vulnerability from nvd – Published: 2024-02-20 09:09 – Updated: 2024-08-01 18:48

Title

OPPO Usercenter Credit sdk

Summary

In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-20 15:24 UTC

CWE

Escalation of Privilege
CWE-280 - Improper Handling of Insufficient Permissions or Privileges

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

2 products

Vendor	Product	Version
OPPO	Usercenter Credit sdk	Affected: /
oppo	usercenter_credit_sdk	Unknown: 0 , < * (custom) cpe:2.3:a:oppo:usercenter_credit_sdk::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oppo:usercenter_credit_sdk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usercenter_credit_sdk",
            "vendor": "oppo",
            "versions": [
              {
                "lessThan": "*",
                "status": "unknown",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1608",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:24:08.747661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-280",
                "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges ",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-27T18:51:36.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:21.911Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1759867611954552832"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Usercenter Credit sdk",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "/"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In OPPO Usercenter Credit SDK, there\u0027s a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction."
            }
          ],
          "value": "In OPPO Usercenter Credit SDK, there\u0027s a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Escalation of Privilege"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-20T09:09:13.528Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1759867611954552832"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Usercenter Credit sdk",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2024-1608",
    "datePublished": "2024-02-20T09:09:13.528Z",
    "dateReserved": "2024-02-19T07:48:52.647Z",
    "dateUpdated": "2024-08-01T18:48:21.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26311 (GCVE-0-2023-26311)

Vulnerability from nvd – Published: 2023-08-10 10:32 – Updated: 2024-10-08 14:50

Title

A remote code execution vulnerability in the webview component of OPPO Store app.

Summary

A remote code execution vulnerability in the webview component of OPPO Store app.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 14:33 UTC

CWE

Remote Code Execution

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Store	Affected: 1.5.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689584995217448960"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26311",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T14:33:02.241396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T14:50:29.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Store",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e A remote code execution vulnerability in the webview component of OPPO Store app.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": " A remote code execution vulnerability in the webview component of OPPO Store app.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-10T10:32:31.287Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689584995217448960"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": " A remote code execution vulnerability in the webview component of OPPO Store app.",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2023-26311",
    "datePublished": "2023-08-10T10:32:31.287Z",
    "dateReserved": "2023-02-21T23:18:21.568Z",
    "dateUpdated": "2024-10-08T14:50:29.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26309 (GCVE-0-2023-26309)

Vulnerability from nvd – Published: 2023-08-10 08:34 – Updated: 2024-10-08 14:50

Title

A remote code execution vulnerability in the webview component

Summary

A remote code execution vulnerability in the webview component of OnePlus Store app.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 14:34 UTC

CWE

Remote Code Execution

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OnePlus Store	Affected: 3.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:23.927Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689464826201645056"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26309",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T14:34:46.417505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T14:50:47.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OnePlus Store",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA remote code execution vulnerability in the webview component of OnePlus Store app.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A remote code execution vulnerability in the webview component of OnePlus Store app.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-11T09:39:08.276Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689464826201645056"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "A remote code execution vulnerability in the webview component",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2023-26309",
    "datePublished": "2023-08-10T08:34:12.390Z",
    "dateReserved": "2023-02-21T23:18:21.567Z",
    "dateUpdated": "2024-10-08T14:50:47.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-23247 (GCVE-0-2021-23247)

Vulnerability from nvd – Published: 2022-04-01 22:17 – Updated: 2024-08-03 19:05

Summary

A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine

Severity

No CVSS data available.

CWE

Remote Code Execution

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	OPPO Quick App	Affected: 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:05:55.554Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OPPO Quick App",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-01T22:17:26.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2021-23247",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OPPO Quick App",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.5.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240",
              "refsource": "MISC",
              "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2021-23247",
    "datePublished": "2022-04-01T22:17:26.000Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:05:55.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-23244 (GCVE-0-2021-23244)

Vulnerability from nvd – Published: 2021-12-27 18:48 – Updated: 2024-08-03 19:05

Summary

ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission.

Severity

No CVSS data available.

CWE

Elevation of privilege

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	OPPO Android Phone	Affected: OPPO Mobile phones with ColorOS 11 version

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:05:54.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OPPO Android Phone",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "OPPO Mobile phones with ColorOS 11 version"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-27T18:48:24.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2021-23244",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OPPO Android Phone",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "OPPO Mobile phones with ColorOS 11 version"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976",
              "refsource": "MISC",
              "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2021-23244",
    "datePublished": "2021-12-27T18:48:24.000Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:05:54.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11831 (GCVE-0-2020-11831)

Vulnerability from nvd – Published: 2020-11-19 15:51 – Updated: 2024-08-04 11:41

Summary

OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1.

Severity

No CVSS data available.

CWE

privilege escalation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticedetails.html?n…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	com.oppo.ovoicemanager	Affected: V2.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:41:59.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "com.oppo.ovoicemanager",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "privilege escalation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-19T15:51:12.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2020-11831",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "com.oppo.ovoicemanager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V2.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "privilege escalation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696",
              "refsource": "CONFIRM",
              "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2020-11831",
    "datePublished": "2020-11-19T15:51:12.000Z",
    "dateReserved": "2020-04-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:41:59.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11830 (GCVE-0-2020-11830)

Vulnerability from nvd – Published: 2020-11-19 15:51 – Updated: 2024-08-04 11:42

Summary

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0.

Severity

No CVSS data available.

CWE

privilege escalation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticedetails.html?n…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	com.oppo.qualityprotect	Affected: V2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.625Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "com.oppo.qualityprotect",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "privilege escalation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-19T15:51:09.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2020-11830",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "com.oppo.qualityprotect",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "privilege escalation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696",
              "refsource": "CONFIRM",
              "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2020-11830",
    "datePublished": "2020-11-19T15:51:09.000Z",
    "dateReserved": "2020-04-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:42:00.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11829 (GCVE-0-2020-11829)

Vulnerability from nvd – Published: 2020-11-19 15:51 – Updated: 2024-08-04 11:42

Summary

Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722.

Severity

No CVSS data available.

CWE

privilege escalation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticedetails.html?n…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	com.coloros.codebook	Affected: V2.0.0_5493e40_200722

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:42:00.232Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "com.coloros.codebook",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0.0_5493e40_200722"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "privilege escalation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-19T15:51:07.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2020-11829",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "com.coloros.codebook",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V2.0.0_5493e40_200722"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493e40_200722."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "privilege escalation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696",
              "refsource": "CONFIRM",
              "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2020-11829",
    "datePublished": "2020-11-19T15:51:07.000Z",
    "dateReserved": "2020-04-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:42:00.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-22072 (GCVE-0-2026-22072)

Vulnerability from cvelistv5 – Published: 2026-08-17 06:13 – Updated: 2026-08-17 15:24

Title

Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Summary

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 15:24 UTC

CWE

CWE-20 - Improper input validation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Health	Affected: 6.2.9 (git)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22072",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T15:24:21.144626Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T15:24:32.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Health",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.9",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
            }
          ],
          "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-639",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-639 Probe System Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T06:13:58.205Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2088198578949595136"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary URL Loading in WebView Leading to Token Leakage Risk",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22072",
    "datePublished": "2026-08-17T06:13:58.205Z",
    "dateReserved": "2026-01-06T06:15:53.764Z",
    "dateUpdated": "2026-08-17T15:24:32.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22078 (GCVE-0-2026-22078)

Vulnerability from cvelistv5 – Published: 2026-06-29 08:05 – Updated: 2026-06-29 11:53

Title

O+ Connect's lack of authentication for IPC channels led to a local privilege escalation vulnerability.

Summary

Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 11:53 UTC

CWE

CWE-266 - Incorrect privilege assignment

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	O+ Connect	Affected: 16.0.33

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22078",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T11:53:04.056229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T11:53:21.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "O+ Connect",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "16.0.33"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Because O+ Connect\u0027s IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel."
            }
          ],
          "value": "Because O+ Connect\u0027s IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect privilege assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T11:52:51.499Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2070415238859333632"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "O+ Connect\u0027s lack of authentication for IPC channels led to a local privilege escalation vulnerability.",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22078",
    "datePublished": "2026-06-29T08:05:49.776Z",
    "dateReserved": "2026-01-06T06:15:53.765Z",
    "dateUpdated": "2026-06-29T11:53:21.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22070 (GCVE-0-2026-22070)

Vulnerability from cvelistv5 – Published: 2026-04-30 08:27 – Updated: 2026-04-30 13:01

Title

ColorOS Assistant Path Traversal Vulnerability

Summary

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-30 13:01 UTC

CWE

CWE-23 - Relative path traversal

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	ColorOS Assistant	Unaffected: 1.4.26

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-30T13:01:03.772357Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-30T13:01:16.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ColorOS Assistant",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.4.26"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal."
            }
          ],
          "value": "ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative path traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-30T08:27:57.043Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2049764240746881024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ColorOS Assistant Path Traversal Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22070",
    "datePublished": "2026-04-30T08:27:57.043Z",
    "dateReserved": "2026-01-06T06:15:53.764Z",
    "dateUpdated": "2026-04-30T13:01:16.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22077 (GCVE-0-2026-22077)

Vulnerability from cvelistv5 – Published: 2026-04-27 06:37 – Updated: 2026-04-27 13:29

Title

Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet

Summary

OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure.

Severity

5.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-27 13:19 UTC

CWE

CWE-346 - Origin Validation Error

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Wallet APP	Affected: all

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T13:19:04.793103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-346",
                "description": "CWE-346 Origin Validation Error",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T13:29:23.859Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Wallet APP",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure."
            }
          ],
          "value": "OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which may lead to account token hijacking and sensitive information disclosure."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "AUTOMATIC",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T07:27:33.199Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-2048652556296790016"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Sensitive Information Disclosure Vulnerability Caused by Trusted Domain Bypass in OPPO Wallet",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2026-22077",
    "datePublished": "2026-04-27T06:37:05.647Z",
    "dateReserved": "2026-01-06T06:15:53.765Z",
    "dateUpdated": "2026-04-27T13:29:23.859Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-27388 (GCVE-0-2025-27388)

Vulnerability from cvelistv5 – Published: 2025-08-14 07:15 – Updated: 2025-08-14 19:37

Title

Arbitrary URL Loading in WebView Leading to Token Leakage Risk

Summary

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-14 19:36 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO HEALTH APP	Affected: 4.23.4 and below , ≤ 4.23.4 (git)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-14T19:36:20.850842Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-14T19:37:41.298Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO HEALTH APP",
          "vendor": "OPPO",
          "versions": [
            {
              "lessThanOrEqual": "4.23.4",
              "status": "affected",
              "version": "4.23.4 and below",
              "versionType": "git"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
            }
          ],
          "value": "Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-639",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-639 Probe System Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-14T07:15:10.875Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1955879800426209280"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary URL Loading in WebView Leading to Token Leakage Risk",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2025-27388",
    "datePublished": "2025-08-14T07:15:10.875Z",
    "dateReserved": "2025-02-24T03:04:32.845Z",
    "dateUpdated": "2025-08-14T19:37:41.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-27387 (GCVE-0-2025-27387)

Vulnerability from cvelistv5 – Published: 2025-06-23 09:28 – Updated: 2026-01-06 06:20

Title

OPPO Clone Phone uses weak WPA passphrase as only means of security

Summary

OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-23 12:09 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	ColorOS	Affected: 15.0.2 and below

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-23T12:09:11.626527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-23T12:14:46.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ColorOS",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "15.0.2 and below"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure."
            }
          ],
          "value": "OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-112",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-112 Brute Force"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-06T06:20:24.543Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1937080145974403072https://"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Clone Phone uses weak WPA passphrase as only means of security",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2025-27387",
    "datePublished": "2025-06-23T09:28:08.244Z",
    "dateReserved": "2025-02-24T03:04:32.845Z",
    "dateUpdated": "2026-01-06T06:20:24.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-1609 (GCVE-0-2024-1609)

Vulnerability from cvelistv5 – Published: 2024-12-25 03:14 – Updated: 2024-12-26 19:52

Title

OPPO Store APP has a WebView component privilege escalation vulnerability.

Summary

In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-26 19:51 UTC

CWE

CWE-287 - Improper Authentication

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPP Store	Affected: 3.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-26T19:51:53.624999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-26T19:52:25.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPP Store",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn OPPOStore iOS App, there\u0027s a possible escalation of privilege due to improper input validation. \u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "In OPPOStore iOS App, there\u0027s a possible escalation of privilege due to improper input validation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-25T03:14:43.216Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Store APP has a WebView component privilege escalation vulnerability.",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2024-1609",
    "datePublished": "2024-12-25T03:14:43.216Z",
    "dateReserved": "2024-02-19T07:48:58.472Z",
    "dateUpdated": "2024-12-26T19:52:25.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1610 (GCVE-0-2024-1610)

Vulnerability from cvelistv5 – Published: 2024-12-18 06:18 – Updated: 2024-12-18 15:33

Title

OPPO Store app include remote account token hijacking and sensitive information leakage

Summary

In OPPO Store APP, there's a possible escalation of privilege due to improper input validation.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-18 15:30 UTC

CWE

CWE-287 - Improper Authentication
CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Store APP	Affected: 4.32.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-1610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-18T15:30:05.310072Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1284",
                "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-18T15:33:31.880Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Store APP",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "4.32.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn OPPO Store APP, there\u0027s a possible escalation of privilege due to improper input validation. \u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "In OPPO Store APP, there\u0027s a possible escalation of privilege due to improper input validation."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-18T06:18:48.588Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1869215920048840704"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Store app include remote account token hijacking and sensitive information leakage",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2024-1610",
    "datePublished": "2024-12-18T06:18:48.588Z",
    "dateReserved": "2024-02-19T07:49:02.096Z",
    "dateUpdated": "2024-12-18T15:33:31.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1608 (GCVE-0-2024-1608)

Vulnerability from cvelistv5 – Published: 2024-02-20 09:09 – Updated: 2024-08-01 18:48

Title

OPPO Usercenter Credit sdk

Summary

In OPPO Usercenter Credit SDK, there's a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-20 15:24 UTC

CWE

Escalation of Privilege
CWE-280 - Improper Handling of Insufficient Permissions or Privileges

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

2 products

Vendor	Product	Version
OPPO	Usercenter Credit sdk	Affected: /
oppo	usercenter_credit_sdk	Unknown: 0 , < * (custom) cpe:2.3:a:oppo:usercenter_credit_sdk::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oppo:usercenter_credit_sdk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "usercenter_credit_sdk",
            "vendor": "oppo",
            "versions": [
              {
                "lessThan": "*",
                "status": "unknown",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1608",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:24:08.747661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-280",
                "description": "CWE-280 Improper Handling of Insufficient Permissions or Privileges ",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-27T18:51:36.363Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:21.911Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1759867611954552832"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Usercenter Credit sdk",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "/"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In OPPO Usercenter Credit SDK, there\u0027s a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction."
            }
          ],
          "value": "In OPPO Usercenter Credit SDK, there\u0027s a possible escalation of privilege due to loose permission check, This could lead to application internal information leak w/o user interaction."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Escalation of Privilege"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-20T09:09:13.528Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1759867611954552832"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OPPO Usercenter Credit sdk",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2024-1608",
    "datePublished": "2024-02-20T09:09:13.528Z",
    "dateReserved": "2024-02-19T07:48:52.647Z",
    "dateUpdated": "2024-08-01T18:48:21.911Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26311 (GCVE-0-2023-26311)

Vulnerability from cvelistv5 – Published: 2023-08-10 10:32 – Updated: 2024-10-08 14:50

Title

A remote code execution vulnerability in the webview component of OPPO Store app.

Summary

A remote code execution vulnerability in the webview component of OPPO Store app.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 14:33 UTC

CWE

Remote Code Execution

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OPPO Store	Affected: 1.5.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.386Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689584995217448960"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26311",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T14:33:02.241396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T14:50:29.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OPPO Store",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e A remote code execution vulnerability in the webview component of OPPO Store app.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": " A remote code execution vulnerability in the webview component of OPPO Store app.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-10T10:32:31.287Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689584995217448960"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": " A remote code execution vulnerability in the webview component of OPPO Store app.",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2023-26311",
    "datePublished": "2023-08-10T10:32:31.287Z",
    "dateReserved": "2023-02-21T23:18:21.568Z",
    "dateUpdated": "2024-10-08T14:50:29.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26309 (GCVE-0-2023-26309)

Vulnerability from cvelistv5 – Published: 2023-08-10 08:34 – Updated: 2024-10-08 14:50

Title

A remote code execution vulnerability in the webview component

Summary

A remote code execution vulnerability in the webview component of OnePlus Store app.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 14:34 UTC

CWE

Remote Code Execution

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…

Impacted products

1 product

Vendor	Product	Version
OPPO	OnePlus Store	Affected: 3.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:23.927Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689464826201645056"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26309",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T14:34:46.417505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T14:50:47.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OnePlus Store",
          "vendor": "OPPO",
          "versions": [
            {
              "status": "affected",
              "version": "3.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA remote code execution vulnerability in the webview component of OnePlus Store app.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A remote code execution vulnerability in the webview component of OnePlus Store app.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-11T09:39:08.276Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1689464826201645056"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "A remote code execution vulnerability in the webview component",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2023-26309",
    "datePublished": "2023-08-10T08:34:12.390Z",
    "dateReserved": "2023-02-21T23:18:21.567Z",
    "dateUpdated": "2024-10-08T14:50:47.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-23247 (GCVE-0-2021-23247)

Vulnerability from cvelistv5 – Published: 2022-04-01 22:17 – Updated: 2024-08-03 19:05

Summary

A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine

Severity

No CVSS data available.

CWE

Remote Code Execution

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	OPPO Quick App	Affected: 4.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:05:55.554Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OPPO Quick App",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-01T22:17:26.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2021-23247",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OPPO Quick App",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.5.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240",
              "refsource": "MISC",
              "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1501448054614794240"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2021-23247",
    "datePublished": "2022-04-01T22:17:26.000Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:05:55.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-23244 (GCVE-0-2021-23244)

Vulnerability from cvelistv5 – Published: 2021-12-27 18:48 – Updated: 2024-08-03 19:05

Summary

ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission.

Severity

No CVSS data available.

CWE

Elevation of privilege

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticeDetail?notice_…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	OPPO Android Phone	Affected: OPPO Mobile phones with ColorOS 11 version

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:05:54.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OPPO Android Phone",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "OPPO Mobile phones with ColorOS 11 version"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-27T18:48:24.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2021-23244",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OPPO Android Phone",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "OPPO Mobile phones with ColorOS 11 version"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelist is not installed, attacker can disguise app with the same package name to obtain dangerous permission."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976",
              "refsource": "MISC",
              "url": "https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE-1474214753353342976"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2021-23244",
    "datePublished": "2021-12-27T18:48:24.000Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:05:54.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-11831 (GCVE-0-2020-11831)

Vulnerability from cvelistv5 – Published: 2020-11-19 15:51 – Updated: 2024-08-04 11:41

Summary

OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1.

Severity

No CVSS data available.

CWE

privilege escalation

Assigner

OPPO mitre root Scorecard

References

1 reference

URL	Tags
https://security.oppo.com/en/noticedetails.html?n…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	com.oppo.ovoicemanager	Affected: V2.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:41:59.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "com.oppo.ovoicemanager",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "privilege escalation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-19T15:51:12.000Z",
        "orgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
        "shortName": "OPPO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@oppo.com",
          "ID": "CVE-2020-11831",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "com.oppo.ovoicemanager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V2.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "privilege escalation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696",
              "refsource": "CONFIRM",
              "url": "https://security.oppo.com/en/noticedetails.html?noticeId=NOTICE-1328876061836189696"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f2b1ad8-5432-4d64-91a1-9099af1cc695",
    "assignerShortName": "OPPO",
    "cveId": "CVE-2020-11831",
    "datePublished": "2020-11-19T15:51:12.000Z",
    "dateReserved": "2020-04-16T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:41:59.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

34 vulnerabilities by OPPO

CVE-2026-22072 (GCVE-0-2026-22072)

CVE-2026-22078 (GCVE-0-2026-22078)

CVE-2026-22070 (GCVE-0-2026-22070)

CVE-2026-22077 (GCVE-0-2026-22077)

CVE-2025-27388 (GCVE-0-2025-27388)

CVE-2025-27387 (GCVE-0-2025-27387)

CVE-2024-1609 (GCVE-0-2024-1609)

CVE-2024-1610 (GCVE-0-2024-1610)

CVE-2024-1608 (GCVE-0-2024-1608)

CVE-2023-26311 (GCVE-0-2023-26311)

CVE-2023-26309 (GCVE-0-2023-26309)

CVE-2021-23247 (GCVE-0-2021-23247)

CVE-2021-23244 (GCVE-0-2021-23244)

CVE-2020-11831 (GCVE-0-2020-11831)

CVE-2020-11830 (GCVE-0-2020-11830)

CVE-2020-11829 (GCVE-0-2020-11829)

CVE-2026-22072 (GCVE-0-2026-22072)

CVE-2026-22078 (GCVE-0-2026-22078)

CVE-2026-22070 (GCVE-0-2026-22070)

CVE-2026-22077 (GCVE-0-2026-22077)

CVE-2025-27388 (GCVE-0-2025-27388)

CVE-2025-27387 (GCVE-0-2025-27387)

CVE-2024-1609 (GCVE-0-2024-1609)

CVE-2024-1610 (GCVE-0-2024-1610)

CVE-2024-1608 (GCVE-0-2024-1608)

CVE-2023-26311 (GCVE-0-2023-26311)

CVE-2023-26309 (GCVE-0-2023-26309)

CVE-2021-23247 (GCVE-0-2021-23247)

CVE-2021-23244 (GCVE-0-2021-23244)

CVE-2020-11831 (GCVE-0-2020-11831)