CVE-2015-9232

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Also, the Good Dynamic application activation process does not attempt to detect malicious activation attempts involving modified names beginning with a com.good.gdgma substring. Consequently, an attacker could obtain access to intranet data. This issue is only relevant in cases where the user has already downloaded a malicious Android application.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92338.8The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to CVE-2015-92347.2The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactform CVE-2015-92359.8In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmet CVE-2015-92365.3Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsistent headers and at w CVE-2015-92385.3secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, CVE-2015-92397.5ansi2html is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.CVE-2015-92407.5Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched CVE-2015-92417.5Certain input passed into the If-Modified-Since or Last-Modified headers will cause an 'illegal access' exception to be raised. Instead of s CVE-2015-92427.5Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. Th CVE-2015-92435.9When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined and when a higher leve CVE-2015-92449.8Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.CVE-2015-92459.8Insecure default configuration in Progress Software OpenEdge 10.2x and 11.x allows unauthenticated remote attackers to specify arbitrary URL