CVE-2024-42041

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-420486.5OpenOrange Business Framework version 1.15.5 installs to a directory with overly permissive access control, allowing all authenticated users CVE-2024-420499.1TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.CVE-2024-42054.3The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the CVE-2024-420507.0The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A loc CVE-2024-420517.8The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation. A loc CVE-2024-420527.8The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A loc CVE-2024-420537.8The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A loc CVE-2024-420545.4Cervantes through 0.5-alpha accepts insecure file uploads.CVE-2024-420555.4Cervantes through 0.5-alpha allows stored XSS.CVE-2024-420566.5Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" CVE-2024-420578.1A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series f CVE-2024-420587.5A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions f