The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by ASUS or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage (i.e., sdcard). The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device.

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains a pre-installed app with a package name of com.asus.loguploader (versionCode=1570000275, versionName=7.0.0.55_170515). This app contains an exported service app component named com.asus.loguploader.LogUploaderService that, when accessed with a particular action string, will write a bugreport (kernel log, logcat log, and the state of system services including the text of active notifications), Wi-Fi Passwords, and other system data to external storage (sdcard). Any app with the READ_EXTERNAL_STORAGE permission on this device can read this data from the sdcard after it has been dumped there by the com.asus.loguploader. Third-party apps are not allowed to directly create a bugreport or access the user's stored wireless network credentials.

An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS, as demonstrated by the name parameter, a different vulnerability than CVE-2018-8070.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/category.php has XSS.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/album.php has XSS.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/news.php has XSS.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/product.php has XSS.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/down.php has XSS.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/slideshow.php has XSS.

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/system.php has XSS.

An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.address.php has SQL Injection via the numPerPage parameter.

An issue was discovered in EMLsoft 5.4.5. upload\eml\action\action.user.php has SQL Injection via the numPerPage parameter.

An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=user&do=add page allows CSRF.

An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF.

An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.

zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI.

zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php.

dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.