Search criteria
9 vulnerabilities found for evo_4g by htc
FKIE_CVE-2012-2217
Vulnerability from fkie_nvd - Published: 2012-05-01 14:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E815F275-7BB3-4E14-92F3-3D52A72CBE7E",
"versionEndIncluding": "4.54.651.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:1.32.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E4654D8F-7355-4141-BD39-0A8ED38F437C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:1.47.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0662E7B8-A831-4167-BEB9-9DD3CCF9F97F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:3.26.651.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9A367B3F-5ADC-422B-A032-D82CD50D761F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:3.29.651.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0B0AA96D-7810-43C3-996F-3BC01B4F6D62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:3.30.651.2:*:*:*:*:*:*:*",
"matchCriteriaId": "02E8E505-CCEA-4052-AF9B-C5EF58DBCBD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:3.30.651.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6FD9E9AA-3DF7-4787-982F-8A0E651DF94D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:3.70.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9D22BA87-3334-4939-B42E-0B3611E8B862",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:4.22.651.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D2408E95-7BFA-4D58-9FDA-9FF05DB2B5C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:4.24.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B6179012-8E51-4BFC-9592-BFA6AAE803D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_4g_software:4.53.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3BCEC1AC-7CCA-409B-8346-35D9A2251FB6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:evo_4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1368A8C3-7F80-4DC4-9ADF-AC69E44CB9FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:evo_4g:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "FF9842B1-3735-48CC-9163-36253B9C5AF6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:htc:evo_design_4g_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7310B73E-B908-4A7D-8495-77454E87BAC6",
"versionEndIncluding": "1.19.651.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_design_4g_software:1.19.651.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7A33CE59-A315-4013-BE89-67EA077B7175",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:evo_design_4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "11B01216-33EC-40A7-9781-2900BCEA15A3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:htc:shift_4g_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2253FDBF-228A-4D3F-ABF9-7AFF03207D99",
"versionEndIncluding": "2.76.651.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:shift_4g_software:1.17.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CB8920D7-3F96-4D13-BDFC-353E841BBE31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:shift_4g_software:2.75.651.4:*:*:*:*:*:*:*",
"matchCriteriaId": "28DA32A0-818E-4442-B22B-A9BEC5052D96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:shift_4g_software:2.75.651.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4407EE19-DE46-49BC-8CBA-D810B084EAD9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:shift_4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2741C50D-A992-49D9-8FC5-A782AE65B0AE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:htc:evo_3d_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8197CEE7-054D-4840-B67C-A25B44068A7D",
"versionEndIncluding": "2.08.651.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_3d_software:1.11.651.3:*:*:*:*:*:*:*",
"matchCriteriaId": "77844462-3FA7-4C46-AFB5-61DD250711AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_3d_software:1.13.651.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7F8636AB-44E1-4135-A13D-975E09812C0E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_3d_software:2.08.651.2:*:*:*:*:*:*:*",
"matchCriteriaId": "693681CD-E6E7-43D5-BC65-78828BDD4A6C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:evo_3d:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F8C77876-DC0F-42CB-B795-0BB5A0A7559A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:evo_3d:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "04CE53C2-E91D-4E99-820A-D06BA1BBAAD3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:htc:evo_view_4g_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7DD5920B-2C35-47B7-A54B-05C214556404",
"versionEndIncluding": "1.22.651.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:evo_view_4g_software:1.22.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BCF81B72-FC57-4979-A44E-CA1BDDE07910",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:evo_view_4g:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BDF0CF5D-A1CC-4703-9E93-04C7C8219CD4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:htc:vivid_software:*:*:*:*:*:*:*:*",
"matchCriteriaId": "91416F0F-82A0-42FA-831C-FF61ADFAE7EF",
"versionEndIncluding": "3.26.502",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:vivid:-:*:*:*:*:*:*:*",
"matchCriteriaId": "977B55E8-22F3-47A9-876D-D0E858118FC3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:htc:hero_software:1.29.651.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7178F17C-1CEF-419F-B7D0-85145807C2BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:hero_software:1.56.651.2:*:*:*:*:*:*:*",
"matchCriteriaId": "77BAD23A-A63F-47A4-9378-BA45A1327C48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:hero_software:2.27.651.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F01536FC-F034-47F8-951E-26C87B40B311",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:hero_software:2.27.651.6:*:*:*:*:*:*:*",
"matchCriteriaId": "5FC961A5-EC4B-4D4B-8465-35C2CC104751",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:hero_software:2.31.651.7:*:*:*:*:*:*:*",
"matchCriteriaId": "C9F56F7E-D65F-4532-8CE1-D434B5BAF8CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:htc:hero_software:2.32.651.2:*:*:*:*:*:*:*",
"matchCriteriaId": "69E23E10-885D-4D8E-B98C-1007CD8C7AD9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:hero:-:*:*:*:*:*:*:*",
"matchCriteriaId": "831A21A7-B190-408D-B220-6A5A023725A7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission."
},
{
"lang": "es",
"value": "El servicio HTC IQRD para Android en HTC EVO 4G antes de v4.67.651.3, EVO Design 4G antes de v2.12.651.5, Shift 4G antes de v2.77.651.3, EVO 3D antes de v2.17.651.5, EVO View 4G antes de v2.23.651.1, Vivid antes de v3.26.502.56, y Hero no restringe el acceso a localhost en el puerto TCP 2479, lo que permite a atacantes remotos (1) enviar mensajes SMS, (2) obtener el identificador de acceso a la red (NAI) y su contrase\u00f1a, o lanzar (3) mensajes emergentes o (4) tonos a trav\u00e9s de una aplicaci\u00f3n modificada que aprovecha el permiso android.permission.INTERNET."
}
],
"id": "CVE-2012-2217",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-05-01T14:55:01.673",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/53187"
},
{
"source": "cve@mitre.org",
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/53187"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2011-4872
Vulnerability from fkie_nvd - Published: 2012-02-05 11:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| htc | desire_hd | frg83d | |
| htc | desire_hd | gri40 | |
| htc | desire_s | gri40 | |
| htc | droid_incredible | frf91 | |
| htc | evo_3d | gri40 | |
| htc | evo_4g | gri40 | |
| htc | glacier | frg83 | |
| htc | sensation_4g | gri40 | |
| htc | sensation_z710e | gri40 | |
| htc | thunderbolt_4g | frg83d |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:desire_hd:frg83d:*:*:*:*:*:*:*",
"matchCriteriaId": "A47D18AA-CFF9-4AD8-AE88-2CA747123EBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:desire_hd:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "F0653264-C983-4944-9C58-FB66695810B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:desire_s:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "F9F69A6B-DE64-40FD-9A0D-4F58A0D40876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:droid_incredible:frf91:*:*:*:*:*:*:*",
"matchCriteriaId": "104EFEA6-6768-4BC4-BB79-636607F6B633",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:evo_3d:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "04CE53C2-E91D-4E99-820A-D06BA1BBAAD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:evo_4g:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "FF9842B1-3735-48CC-9163-36253B9C5AF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:glacier:frg83:*:*:*:*:*:*:*",
"matchCriteriaId": "41DA09C0-2C0F-4605-A9ED-B76436FC8969",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:sensation_4g:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "8A373B93-7BA1-474E-99E8-B0507A317C7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:sensation_z710e:gri40:*:*:*:*:*:*:*",
"matchCriteriaId": "8F11BB06-D097-48F9-9B39-28916BB3CA1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:thunderbolt_4g:frg83d:*:*:*:*:*:*:*",
"matchCriteriaId": "4F8DC280-89A4-482C-BCBA-7721E898935A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class."
},
{
"lang": "es",
"value": "M\u00faltiples dispositivos Android HTC incluyendo Desire HD FRG83D y GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40 y EVO 4G GRI40 permiten a atacantes remotos obtener las credenciales Wi-Fi 802.1X y el SSID a trav\u00e9s de una aplicaci\u00f3n modificada que utiliza el permiso android.permission.ACCESS_WIFI_STATE para invocar el m\u00e9todo toString en la clase WifiConfiguration."
}
],
"id": "CVE-2011-4872",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-02-05T11:55:03.047",
"references": [
{
"source": "cret@cert.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"source": "cret@cert.org",
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"source": "cret@cert.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/47837"
},
{
"source": "cret@cert.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"source": "cret@cert.org",
"url": "http://www.securityfocus.com/bid/51790"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/47837"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/51790"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2011-3975
Vulnerability from fkie_nvd - Published: 2011-10-03 15:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:google:android:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D634E2E3-4E8A-4C88-A6BF-DBE7439EB3B0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:htc:evo_3d:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F8C77876-DC0F-42CB-B795-0BB5A0A7559A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:evo_4g:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8905569F-33A9-4C8A-A27F-B1385FE68A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:htc:thunderbolt:*:*:*:*:*:*:*:*",
"matchCriteriaId": "15115C5B-BC98-4585-AF8D-CFA668AF6551",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port."
},
{
"lang": "es",
"value": "Determinadas actualizaciones de HTC para Android v2.3.4 BuildGRJ22, cuando se utiliza la interfaz Sense en el dispositivo HTC EVO 3D, EVO 4G, ThunderBolt, y otros dispositivos no especificados, proporcionan la aplicaci\u00f3n HtcLoggers.apk, que permite obtener, a atacantes remotos asistidos por el usuario, una lista de n\u00fameros de tel\u00e9fono de un fichero de log y otra informaci\u00f3n sensible, aprovechando el permiso \u0027android.permission.INTERNET\u0027 de la aplicaci\u00f3n y el establecimiento de sesiones TCP a la IP 127.0.0.1 en el puerto 65511 y un segundo puerto."
}
],
"id": "CVE-2011-3975",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-10-03T15:55:01.147",
"references": [
{
"source": "cve@mitre.org",
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"source": "cve@mitre.org",
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/49916"
},
{
"source": "cve@mitre.org",
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/49916"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2012-2217 (GCVE-0-2012-2217)
Vulnerability from cvelistv5 – Published: 2012-05-01 14:00 – Updated: 2024-08-06 19:26
VLAI?
Summary
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:26:08.929Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53187",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/53187"
},
{
"name": "htc-iqrd-sec-bypass(75080)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
},
{
"name": "20120421 HTC IQRD Android Permission Leakage (CVE-2012-2217)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-04-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-13T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53187",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/53187"
},
{
"name": "htc-iqrd-sec-bypass(75080)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
},
{
"name": "20120421 HTC IQRD Android Permission Leakage (CVE-2012-2217)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-2217",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53187",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/53187"
},
{
"name": "htc-iqrd-sec-bypass(75080)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
},
{
"name": "20120421 HTC IQRD Android Permission Leakage (CVE-2012-2217)",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"name": "http://www.vsecurity.com/resources/advisory/20120420-1/",
"refsource": "MISC",
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-2217",
"datePublished": "2012-05-01T14:00:00",
"dateReserved": "2012-04-10T00:00:00",
"dateUpdated": "2024-08-06T19:26:08.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4872 (GCVE-0-2011-4872)
Vulnerability from cvelistv5 – Published: 2012-02-05 11:00 – Updated: 2024-09-17 02:37
VLAI?
Summary
Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:16:35.135Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#763355",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"name": "20120201 802.1X password exploit on many HTC Android devices",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"name": "47837",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/47837"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"name": "51790",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/51790"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-02-05T11:00:00Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#763355",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"name": "20120201 802.1X password exploit on many HTC Android devices",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"name": "47837",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/47837"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"name": "51790",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/51790"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2011-4872",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#763355",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"name": "20120201 802.1X password exploit on many HTC Android devices",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"name": "47837",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/47837"
},
{
"name": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html",
"refsource": "MISC",
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"name": "51790",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/51790"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2011-4872",
"datePublished": "2012-02-05T11:00:00Z",
"dateReserved": "2011-12-21T00:00:00Z",
"dateUpdated": "2024-09-17T02:37:18.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3975 (GCVE-0-2011-3975)
Vulnerability from cvelistv5 – Published: 2011-10-03 15:00 – Updated: 2024-08-06 23:53
VLAI?
Summary
A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:32.558Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "49916",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/49916"
},
{
"name": "htc-htcloggers-info-disclosure(70270)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-10-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "49916",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/49916"
},
{
"name": "htc-htcloggers-info-disclosure(70270)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3975",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "49916",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/49916"
},
{
"name": "htc-htcloggers-info-disclosure(70270)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
},
{
"name": "http://news.cnet.com/8301-1035_3-20114556-94/",
"refsource": "MISC",
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"name": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports",
"refsource": "MISC",
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"name": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/",
"refsource": "MISC",
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3975",
"datePublished": "2011-10-03T15:00:00",
"dateReserved": "2011-10-03T00:00:00",
"dateUpdated": "2024-08-06T23:53:32.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-2217 (GCVE-0-2012-2217)
Vulnerability from nvd – Published: 2012-05-01 14:00 – Updated: 2024-08-06 19:26
VLAI?
Summary
The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:26:08.929Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53187",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/53187"
},
{
"name": "htc-iqrd-sec-bypass(75080)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
},
{
"name": "20120421 HTC IQRD Android Permission Leakage (CVE-2012-2217)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-04-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-13T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "53187",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/53187"
},
{
"name": "htc-iqrd-sec-bypass(75080)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
},
{
"name": "20120421 HTC IQRD Android Permission Leakage (CVE-2012-2217)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-2217",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The HTC IQRD service for Android on the HTC EVO 4G before 4.67.651.3, EVO Design 4G before 2.12.651.5, Shift 4G before 2.77.651.3, EVO 3D before 2.17.651.5, EVO View 4G before 2.23.651.1, Vivid before 3.26.502.56, and Hero does not restrict localhost access to TCP port 2479, which allows remote attackers to (1) send SMS messages, (2) obtain the Network Access Identifier (NAI) and its password, or trigger (3) popup messages or (4) tones via a crafted application that leverages the android.permission.INTERNET permission."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53187",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/53187"
},
{
"name": "htc-iqrd-sec-bypass(75080)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75080"
},
{
"name": "20120421 HTC IQRD Android Permission Leakage (CVE-2012-2217)",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0176.html"
},
{
"name": "http://www.vsecurity.com/resources/advisory/20120420-1/",
"refsource": "MISC",
"url": "http://www.vsecurity.com/resources/advisory/20120420-1/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-2217",
"datePublished": "2012-05-01T14:00:00",
"dateReserved": "2012-04-10T00:00:00",
"dateUpdated": "2024-08-06T19:26:08.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4872 (GCVE-0-2011-4872)
Vulnerability from nvd – Published: 2012-02-05 11:00 – Updated: 2024-09-17 02:37
VLAI?
Summary
Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:16:35.135Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#763355",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"name": "20120201 802.1X password exploit on many HTC Android devices",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"name": "47837",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/47837"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"name": "51790",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/51790"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-02-05T11:00:00Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#763355",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"name": "20120201 802.1X password exploit on many HTC Android devices",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"name": "47837",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/47837"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"name": "51790",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/51790"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2011-4872",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple HTC Android devices including Desire HD FRG83D and GRI40, Glacier FRG83, Droid Incredible FRF91, Thunderbolt 4G FRG83D, Sensation Z710e GRI40, Sensation 4G GRI40, Desire S GRI40, EVO 3D GRI40, and EVO 4G GRI40 allow remote attackers to obtain 802.1X Wi-Fi credentials and SSID via a crafted application that uses the android.permission.ACCESS_WIFI_STATE permission to call the toString method on the WifiConfiguration class."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#763355",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/763355"
},
{
"name": "20120201 802.1X password exploit on many HTC Android devices",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0002.html"
},
{
"name": "47837",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/47837"
},
{
"name": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html",
"refsource": "MISC",
"url": "http://blog.mywarwithentropy.com/2012/02/8021x-password-exploit-on-many-htc.html"
},
{
"name": "51790",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/51790"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2011-4872",
"datePublished": "2012-02-05T11:00:00Z",
"dateReserved": "2011-12-21T00:00:00Z",
"dateUpdated": "2024-09-17T02:37:18.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3975 (GCVE-0-2011-3975)
Vulnerability from nvd – Published: 2011-10-03 15:00 – Updated: 2024-08-06 23:53
VLAI?
Summary
A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:32.558Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "49916",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/49916"
},
{
"name": "htc-htcloggers-info-disclosure(70270)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-10-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "49916",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/49916"
},
{
"name": "htc-htcloggers-info-disclosure(70270)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3975",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A certain HTC update for Android 2.3.4 build GRJ22, when the Sense interface is used on the HTC EVO 3D, EVO 4G, ThunderBolt, and unspecified other devices, provides the HtcLoggers.apk application, which allows user-assisted remote attackers to obtain a list of telephone numbers from a log, and other sensitive information, by leveraging the android.permission.INTERNET application permission and establishing TCP sessions to 127.0.0.1 on port 65511 and a second port."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "49916",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/49916"
},
{
"name": "htc-htcloggers-info-disclosure(70270)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70270"
},
{
"name": "http://news.cnet.com/8301-1035_3-20114556-94/",
"refsource": "MISC",
"url": "http://news.cnet.com/8301-1035_3-20114556-94/"
},
{
"name": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports",
"refsource": "MISC",
"url": "http://www.thetechherald.com/article.php/201140/7676/HTC-looking-into-vulnerability-reports"
},
{
"name": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/",
"refsource": "MISC",
"url": "http://www.androidpolice.com/2011/10/01/massive-security-vulnerability-in-htc-android-devices-evo-3d-4g-thunderbolt-others-exposes-phone-numbers-gps-sms-emails-addresses-much-more/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3975",
"datePublished": "2011-10-03T15:00:00",
"dateReserved": "2011-10-03T00:00:00",
"dateUpdated": "2024-08-06T23:53:32.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}