CVE-2018-10500

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of push messages. The issue lies in the ability to start an activity with controlled arguments. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5331.

• CWE-284

• https://zerodayinitiative.com/advisories/ZDI-18-559Third Party Advisory, VDB Entry
• https://zerodayinitiative.com/advisories/ZDI-18-559Third Party Advisory, VDB Entry

Published

Sep 24, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10495This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-10496This vulnerability allows remote attackers to execute arbitr…
• CVE-2018-10497This vulnerability allows local attackers to escalate privil…
• CVE-2018-10498This vulnerability allows local attackers to disclose sensit…
• CVE-2018-10499This vulnerability allows local attackers to execute arbitra…
• CVE-2018-1050All versions of Samba from 4.0.0 onwards are vulnerable to a…4.3
• CVE-2018-10501This vulnerability allows local attackers to escalate privil…
• CVE-2018-10502This vulnerability allows local attackers to escalate privil…
• CVE-2018-10503An issue was discovered in index.php in baijiacms V4 v4_1_4_…8.8
• CVE-2018-10504The WebDorado "Form Maker by WD" plugin before 1.12.24 for W…
• CVE-2018-10505A pool corruption privilege escalation vulnerability in Tren…
• CVE-2018-10506A out-of-bounds read information disclosure vulnerability in…