CVE-2024-28745

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on the user's device to access an arbitrary URL on 'ABEMA' App for Android via Intent. If this vulnerability is exploited, an arbitrary website may be displayed on the app, and as a result, the user may become a victim of a phishing attack.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-287468.1Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resou CVE-2024-287479.8An unauthenticated remote attacker can use the hard-coded credentials to access the SmartSPS devices with high privileges.CVE-2024-287487.2A remote attacker with high privileges may use a reading file function to inject OS commands.CVE-2024-287497.2A remote attacker with high privileges may use a writing file function to inject OS commands.CVE-2024-287507.2A remote attacker with high privileges may use a deleting file function to inject OS commands.CVE-2024-287519.1An high privileged remote attacker can enable telnet access that accepts hardcoded credentials.CVE-2024-287529.3A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF CVE-2024-287536.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.CVE-2024-287547.5RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.CVE-2024-287556.5An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum CVE-2024-287565.9The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (Mi CVE-2024-287577.5libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityP