Ch0Pin

**Name of the Vulnerable Software and Affected Versions** Nextcloud Talk Android versions prior to 17.0.0 **Description** Nextcloud Talk Android allows users to place video and audio calls through Nextcloud on Android. An unprotected intent in versions prior to 17.0.0 allowed malicious third-party apps to trick the Talk Android app into writing files outside of its intended cache directory. **Recommendations** For versions prior to 17.0.0, update to version 17.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the app's cache directory until the update is applied.

**Name of the Vulnerable Software and Affected Versions** imo.im version 2022.11.1051 **Description** A path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's data directory. This may allow an attacker to save a shared library under a special directory which the app uses to dynamically load modules. Loading the library can lead to arbitrary code execution. **Recommendations** For imo.im version 2022.11.1051, as a temporary workaround, consider restricting the use of deeplinks until a patch is available. Avoid using unsanitized deeplinks in the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.