Threats tagged 'ghsa-vjh3-543q-39mr'

Alan: Health Insurance for Android version 1.450.0 contains a path traversal vulnerability in its exported ShareReceiverActivity. This flaw allows a malicious co-resident app to write files outside the intended directory by exploiting an unsanitized _display_name parameter from a shared content URI. An attacker can craft an ACTION_SEND intent with directory traversal sequences to overwrite sensitive files within the app's sandbox, such as databases and WebView data, potentially enabling state tampering or code execution without authentication or user interaction.