CVE-2020-7705

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters and NSURLProtocol methods along with anti-debug and proxy detection protection. If those hooks are active MintegralAdSDK sends obfuscated data about every opened URL in an application to their servers. Note that the malicious functionality is enabled even if the SDK was not enabled to serve ads.

• CWE-1021

• https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/Third Party Advisory
• https://snyk.io/research/sour-mint-malicious-sdk/Third Party Advisory
• https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852Third Party Advisory
• https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios/Third Party Advisory
• https://snyk.io/research/sour-mint-malicious-sdk/Third Party Advisory
• https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852Third Party Advisory

Published

Aug 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7699This affects the package express-fileupload before 1.1.8. If…9.8
• CVE-2020-7700All versions of phpjs are vulnerable to Prototype Pollution …9.8
• CVE-2020-7701madlib-object-utils before 0.1.7 is vulnerable to Prototype …9.8
• CVE-2020-7702All versions of package templ8 are vulnerable to Prototype P…9.8
• CVE-2020-7703All versions of package nis-utils are vulnerable to Prototyp…9.8
• CVE-2020-7704The package linux-cmdline before 1.0.1 are vulnerable to Pro…9.8
• CVE-2020-7706The package connie-lang before 0.1.1 are vulnerable to Proto…9.8
• CVE-2020-7707The package property-expr before 2.0.3 are vulnerable to Pro…9.8
• CVE-2020-7708The package irrelon-path before 4.7.0; the package @irrelon/…9.8
• CVE-2020-7709This affects the package json-pointer before 0.6.1. Multiple…7.2
• CVE-2020-7710This affects all versions of package safe-eval. It is possib…9.8
• CVE-2020-7711This affects all versions of package github.com/russellhaeri…7.5