CVE-2019-9140

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a specific malicious URL.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-94 CWE-601

Affected software

Vendor	Product	Versions
SPC CLOUD	Happypoint mobile app	>= 6.3.19, <= 6.3.19

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35103Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35103Third Party Advisory

Timeline

Published: Aug 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-91419.8ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary CVE-2019-91426.1An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/Setting CVE-2019-91438.8An issue was discovered in Exiv2 0.27. There is infinite recursion at Exiv2::Image::printTiffStructure in the file image.cpp. This can be tr CVE-2019-91448.8An issue was discovered in Exiv2 0.27. There is infinite recursion at BigTiffImage::printIFD in the file bigtiffimage.cpp. This can be trigg CVE-2019-91456.1An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.CVE-2019-91467.5Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to CVE-2019-91474.3Mailvelope prior to 3.1.0 is vulnerable to a clickjacking attack against the settings page. As the settings page is intended to be accessibl CVE-2019-91484.3Mailvelope prior to 3.3.0 accepts or operates with invalid PGP public keys: Mailvelope allows importing keys that contain users without a va CVE-2019-91496.5Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailve CVE-2019-91505.3Mailvelope prior to 3.3.0 does not require user interaction to import public keys shown on web page. This functionality can be tricked to ei CVE-2019-91518.8An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5VM_memcpyvv in H5VM.c when called f CVE-2019-91528.8An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5MM_xstrdup in H5MM.c when called fr