CVE-2023-29459

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary content into the context of the application. This can occur via the fcrbs schema or an explicit intent invocation.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-29468.1Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-294609.8An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially a CVE-2023-294619.8An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially a CVE-2023-294628.8An arbitrary code execution vulnerability contained in Rockwell Automation's Arena Simulation software was reported that could potentially a CVE-2023-294635.4The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, CVE-2023-294649.1FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted mal CVE-2023-294655.5SageMath FlintQS 1.0 relies on pathnames under TMPDIR (typically world-writable), which (for example) allows a local user to overwrite files CVE-2023-294689.8The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_E CVE-2023-294696.5An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c CVE-2023-29474.8Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-294715.5Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain clear CVE-2023-294739.8webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attac