CVE-2019-10875

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to the way they handle the "q" query parameter. The portion of an https URL before the ?q= substring is not shown to the user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/152497/Xiaomi-Mi-Browser-Mint-Browser-URL-Spoofing.htmlThird Party Advisory, VDB Entry
https://sec.xiaomi.com/bug/5bedef67a31ec71ePermissions Required, Vendor Advisory
https://thehackernews.com/2019/04/xiaomi-browser-vulnerability.htmlExploit, Third Party Advisory
https://www.andmp.com/2019/04/xiaomi-url-spoofing-w-ssl-vulnerability.htmlExploit, Third Party Advisory
http://packetstormsecurity.com/files/152497/Xiaomi-Mi-Browser-Mint-Browser-URL-Spoofing.htmlThird Party Advisory, VDB Entry
https://sec.xiaomi.com/bug/5bedef67a31ec71ePermissions Required, Vendor Advisory
https://thehackernews.com/2019/04/xiaomi-browser-vulnerability.htmlExploit, Third Party Advisory
https://www.andmp.com/2019/04/xiaomi-url-spoofing-w-ssl-vulnerability.htmlExploit, Third Party Advisory

Timeline

Published: Apr 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-108766.5An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups CVE-2019-108779.8In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multip CVE-2019-108789.8In Teeworlds 0.7.2, there is a failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions in CVE-2019-108799.8In Teeworlds 0.7.2, there is an integer overflow in CDataFileReader::Open() in engine/shared/datafile.cpp that can lead to a buffer overflow CVE-2019-10887.8An elevation of privilege exists in Windows Audio Service, aka 'Windows Audio Service Elevation of Privilege Vulnerability'. This CVE ID is CVE-2019-108809.8Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "CVE-2019-108819.8Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 include CVE-2019-108827.8The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections CVE-2019-108839.8Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.CVE-2019-108848.8Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and sub-domains. The vul CVE-2019-108857.8An issue was discovered in Ivanti Workspace Control before 10.3.90.0. Local authenticated users with low privileges in a Workspace Control m CVE-2019-108865.9An incorrect access control exists in the Sony Photo Sharing Plus application in the firmware before PKG6.5629 version (for the X7500D TV an