CVE-2024-6295

LowCVSS 3.9/10Last modified Jun 17, 2026

Description

udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn.

Metrics

CVSS 3.1 3.9/10CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-922

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-62966.4The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ param CVE-2024-629710.0Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat acto CVE-2024-62989.8Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Atta CVE-2024-62993.7Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forg CVE-2024-63005.3Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU befo CVE-2024-63017.5Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user from any server in most EDUs CVE-2024-63025.5Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local user to redact any message fro CVE-2024-63038.8Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be CVE-2024-63076.4WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sa CVE-2024-63089.8A vulnerability was found in itsourcecode Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability a CVE-2024-63098.8The Attachment File Icons (AF Icons) plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions u CVE-2024-63108.8The Advanced AJAX Page Loader plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, a