GCVE - cpe:2.3:a:tiktok:tiktok:*:*:*:*:*:android:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:tiktok:tiktok:*:*:*:*:*:android:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-45240`	vulnerable	2026-06-08 06:45:55.629616	Details available The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.) Published: 2024-08-24T00:00:00.000Z Updated: 2024-11-05T21:59:50.639Z Open on db.gcve.eu Reference links https://hackerone.com/reports/2417516	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-28799`	vulnerable	2026-06-08 05:42:45.823000	Details available The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached JavaScript interface for the takeover with one click. Published: 2022-05-30T13:46:19.000Z Updated: 2024-08-03T06:03:53.125Z Open on db.gcve.eu Reference links https://support.tiktok.com/en/safety-hc/reporting-security-vulnerabilities/reporting-the-security-vulnerabilities https://hackerone.com/reports/1500614 https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-v39p-88q5-5cvr	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.