CVE-2024-2567

LowCVSS 1.8/10Last modified Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in jurecapuder AndroidWeatherApp 1.0.0 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. VDB-257070 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The code maintainer was contacted early about this disclosure but did not respond in any way. Instead the GitHub repository got deleted after a few days. We have to assume that the product is not supported anymore.

Metrics

CVSS 3.1 1.8/10CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-530

Affected software

No affected versions have been published.

Timeline

Published: Mar 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-256736.1Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.CVE-2024-256749.8An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and CVE-2024-256759.8An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to CVE-2024-256764.7An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads CVE-2024-256778.8In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin CVE-2024-256789.8In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.CVE-2024-256796.5In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by se CVE-2024-25687.2A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functiona CVE-2024-25699.8A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some u CVE-2024-256904.7There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker CVE-2024-256916.1There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and below which may allow a remote, unauthenticated attacker CVE-2024-256925.4There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.1 and below that may in some cases allow a remote,