MEDIUM🇵🇱 Wersja polska

CVE-2019-10875

CVSS 6.5v3.1pub. 2019-04-05upd. 2024-11-21

A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to the way they handle the "q" query parameter. The portion of an https URL before the ?q= substring is not shown to the user.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

  • Mi Browser

    APP
    Mi
    10.5.6-g

  • Mi Mint Browser

    APP
    Mi
    1.5.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2020-14116HIGH7.5ten sam produkt

An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser ...

CVE-2019-13321HIGH8.0ten sam produkt

This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xi...

CVE-2019-13322HIGH8.8ten sam produkt

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Bro...

CVE-2024-4405CRITICAL9.6PL ✓ten sam vendor

XSS umożliwiający RCE w Xiaomi 13 Pro — plik manual-upgrade.html

CVE-2024-4406CRITICAL9.6PL ✓ten sam vendor

XSS umożliwiający RCE w aplikacji GetApps na Xiaomi 13 Pro