CVE-2019-9140

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-94CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Aug 1, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-91419.8ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitraryCVE-2019-91426.1An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingCVE-2019-91438.8An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be trCVE-2019-91448.8An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be triggCVE-2019-91456.1An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.CVE-2019-91467.5Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature toCVE-2019-91474.3Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessiblCVE-2019-91484.3Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a vaCVE-2019-91496.5Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in MailveCVE-2019-91505.3Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to eiCVE-2019-91518.8An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5VM_memcpyvv in H5VM.c when called fCVE-2019-91528.8An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5MM_xstrdup in H5MM.c when called fr
CVE-2019-9140: High severity, CVSS 8.1 | Vulnix