android.com.pl
Vulnerability disclosure program on security.txt android.com.pl
Accepting reports
security.txt
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 20
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
Scope
1 asset you may test.
Domains 1
- android.com.pl
Changes
Tracked since 12 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-8913 | A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. A malicious attacker could create an apk which targets a specific application, and if a victim were to install this apk, the attacker could perform a directory traversal, execute code as the targeted application and access the targeted application's dat | High 8.8 | 12 Aug 2020 |
| CVE-2011-4697 | The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android does not properly protect data, which allows remote attackers to read or modify messaging information via a crafted application. | Medium 6.4 | 25 Jan 2012 |
| CVE-2011-4698 | The AndroidAppTools Easy Filter (com.phoneblocker.android) application 1.1 and 1.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and call records via a crafted application. | Medium 6.4 | 25 Jan 2012 |
| CVE-2011-4699 | The Ubermedia Twidroyd Legacy (com.twidroydlegacy) application 4.3.11 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application. | Medium 6.4 | 25 Jan 2012 |
| CVE-2011-4700 | The UberMedia UberSocial (com.twidroid) application 7.x before 7.2.4 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4701 | The CallConfirm (jp.gr.java_conf.ofnhwx.callconfirm) application 2.0.0 for Android does not properly protect data, which allows remote attackers to read or modify allow/block lists via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4702 | The Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data, which allows remote attackers to read or modify a contact list via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4703 | The Limit My Call (com.limited.call.view) application 2.11 for Android does not properly protect data, which allows remote attackers to read or modify call logs and a contact list via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4704 | The Voxofon (com.voxofon) application before 2.5.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS information via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4705 | The Ming Blacklist Free (vc.software.blacklist) application 1.8.1 and 1.9.2.1 for Android does not properly protect data, which allows remote attackers to read or modify blacklists and a contact list via a crafted application that launches a "data-flow attack." | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4769 | The 360 MobileSafe (com.qihoo360.mobilesafe) application 2.x before 2.3.0 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4770 | The QIWI Wallet (ru.mw) application before 1.14.2 for Android does not properly protect data, which allows remote attackers to read or modify financial information via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4771 | The Scan to PDF Free (com.scan.to.pdf.trial) application 2.0.4 for Android does not properly protect data, which allows remote attackers to read or modify scanned files and a Google account via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4772 | The 360 KouXin (com.qihoo360.kouxin) application 1.5.3 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4773 | The AnGuanJia (com.anguanjia.safe) application 2.10.343 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2011-4866 | The Kaixin001 (com.kaixin001.activity) application 1.3.1 and 1.3.3 for Android does not properly protect data, which allows remote attackers to read or modify contact information and a cleartext password via a crafted application. | Medium 6.4 | 25 Jan 2012 |
| CVE-2011-4867 | The Tencent QQPhoto (com.tencent.qqphoto) application 0.97 for Android does not properly protect data, which allows remote attackers to read or modify contact information and a password hash via a crafted application. | Medium 5.8 | 25 Jan 2012 |
| CVE-2008-7298 | The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue. | Medium 5.8 | 9 Aug 2011 |
| CVE-2009-0608 | Integer overflow in the showLog function in fake_log_device.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines. | High 7.2 | 17 Feb 2009 |
| CVE-2009-0475 | Integer underflow in the Huffman decoding functionality (pvmp3_huffman_parsing.cpp) in OpenCORE 2.0 and earlier allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a crafted MP3 file that triggers heap corruption. | Medium 6.8 | 11 Feb 2009 |