Yu

Name of the Vulnerable Software and Affected Versions: com.transsion.videocallenhancer version 1.1.9.973 Description: The mobile application interface has improper permission control, which can lead to the risk of private file leakage. This issue can result in unauthorized access to private files. Recommendations: For version 1.1.9.973, update the app immediately and review file permissions to mitigate the risk of private file leakage. As a temporary workaround, consider restricting access to sensitive files until the issue is resolved.

The issue concerns Remote Code Execution (RCE) via the `set` function. total.js is a framework for Node.js, similar to other frameworks like Laravel or Django, and can be used for various applications. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue allows remote files to be executed by setting the arguments to the ActiveX method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.

The issue allows an attacker to cause arbitrary code execution due to a file download vulnerability in the ZInsX.ocx ActiveX Control of Zoneplayer on Windows.