deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-4092
Published: 2019-04-25
Description: IBM Content Navigator 2.0.3 and 3.0CD could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 157654.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.ibm.com/support/docview.wss?uid=ibm10874754; https://exchange.xforce.ibmcloud.com/vulnerabilities/157654; http://www.ibm.com/support/docview.wss?uid=ibm10874754
CVE: CVE-2019-4146
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to obtain sensitive document information under unusual circumstances. IBM X-Force ID: 158401.
CVSS Score: 3.1 (LOW)
References: http://www.securityfocus.com/bid/108110; https://exchange.xforce.ibmcloud.com/vulnerabilities/158401; https://www.ibm.com/support/docview.wss?uid=ibm10880595
CVE: CVE-2019-4148
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158414.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158414; https://www.ibm.com/support/docview.wss?uid=ibm10880591; https://exchange.xforce.ibmcloud.com/vulnerabilities/158414
CVE: CVE-2019-4222
Published: 2019-04-25
Description: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/108110; https://exchange.xforce.ibmcloud.com/vulnerabilities/159231; https://www.ibm.com/support/docview.wss?uid=ibm10880595
CVE: CVE-2019-4238
Published: 2019-04-25
Description: IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 159464.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/159464; https://www.ibm.com/support/docview.wss?uid=ibm10881165; https://exchange.xforce.ibmcloud.com/vulnerabilities/159464
CVE: CVE-2019-9900
Published: 2019-04-25
Description: When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
CVSS Score: 8.3 (HIGH)
CWE: CWE-74
References: https://access.redhat.com/errata/RHSA-2019:0741; https://github.com/envoyproxy/envoy/issues/6434; https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h
CVE: CVE-2018-20052
Published: 2019-04-25
Description: An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities that could be used to escalate privileges to root. One example is the "sudo ln -s /tmp/script /etc/cron.hourly/script" command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1188
References: https://www.securifera.com/advisories/cve-2018-20052-20053/; https://www.securifera.com/advisories/cve-2018-20052-20053/
CVE: CVE-2018-20053
Published: 2019-04-25
Description: An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The hostname, timezone, and NTP server configurations on the CCE device are vulnerable to command injection by sending a crafted configuration file over the network.
CVSS Score: 9.8 (CRITICAL)
References: https://www.securifera.com/advisories/cve-2018-20052-20053/; https://www.securifera.com/advisories/cve-2018-20052-20053/
CVE: CVE-2019-9901
Published: 2019-04-25
Description: Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-706
References: https://github.com/envoyproxy/envoy/issues/6435; https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w; https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
CVE: CVE-2017-16558
Published: 2019-04-25
Description: Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://contao.org/de/changelog/versions/4.4.html; https://contao.org/en/news/contao-4_4_8.html; https://contao.org/de/changelog/versions/4.4.html
CVE: CVE-2018-18369
Published: 2019-04-25
Description: Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/107997; https://support.symantec.com/en_US/article.SYMSA1479.html; http://www.securityfocus.com/bid/107997
CVE: CVE-2018-19442
Published: 2019-04-25
Description: A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary code with root privileges via a crafted POST request to a vendors/neato/robots/[robot_serial]/messages Neato cloud URI on the nucleo.neatocloud.com web site (port 4443).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://media.ccc.de/v/eh19-157-smart-vacuum-cleaners-as-remote-wiretapping-devices#t=1779; https://www.usenix.org/system/files/woot19-paper_ullrich.pdf; https://media.ccc.de/v/eh19-157-smart-vacuum-cleaners-as-remote-wiretapping-devices#t=1779
CVE: CVE-2019-9135
Published: 2019-04-25
Description: DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed DIB format file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE: CVE-2019-9136
Published: 2019-04-25
Description: DaviewIndy 8.98.7 and earlier versions have a Heap-based overflow vulnerability, triggered when the user opens a malformed JPEG2000 format file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE: CVE-2018-1360
Published: 2019-04-25
Description: A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319
References: http://www.securityfocus.com/bid/108079; https://fortiguard.com/advisory/FG-IR-18-051; http://www.securityfocus.com/bid/108079
CVE: CVE-2019-10955
Published: 2019-04-25
Description: In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, CompactLogix 5370 L1 controllers v30.014 and earlier, CompactLogix 5370 L2 controllers v30.014 and earlier, CompactLogix 5370 L3 controllers (includes CompactLogix GuardLogix controllers) v30.014 and earlier, an open redirect vulnerability could allow a remote unauthenticated attacker to input a malicious link to redirect users to a malicious site that could run or download arbitrary malware on the user’s machine.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://ics-cert.us-cert.gov/advisories/ICSA-19-113-01; https://www.securityfocus.com/bid/108049; https://ics-cert.us-cert.gov/advisories/ICSA-19-113-01
CVE: CVE-2019-9137
Published: 2019-04-25
Description: DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed Image file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE: CVE-2019-9138
Published: 2019-04-25
Description: DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PhotoShop file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE: CVE-2019-9139
Published: 2019-04-25
Description: DaviewIndy 8.98.7 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34995
CVE: CVE-2018-12244
Published: 2019-04-25
Description: SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a type of issue whereby an application or website allows untrusted input into CSV files.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1236
References: https://support.symantec.com/en_US/article.SYMSA1479.html; https://www.securityfocus.com/bid/107999; https://support.symantec.com/en_US/article.SYMSA1479.html
CVE: CVE-2018-18286
Published: 2019-04-25
Description: SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdf; https://www.mitel.com/en-gb/support/security-advisories/mitel-product-security-adivsory-19-0003-001; https://www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdf
CVE: CVE-2019-11537
Published: 2019-04-25
Description: In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/osTicket/osTicket/pull/4869; https://github.com/osTicket/osTicket/releases/tag/v1.12; https://pentest.com.tr/exploits/osTicket-v1-11-XSS-to-LFI.html
CVE: CVE-2019-9669
Published: 2019-04-25
Description: The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities)
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.edgescan.com/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan/; https://www.edgescan.com/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan/
CVE: CVE-2018-14557
Published: 2019-04-25
Description: An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the page parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, a causing buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-03/Tenda.md; https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-03/Tenda.md
CVE: CVE-2018-14559
Published: 2019-04-25
Description: An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A buffer overflow vulnerability exists in the router's web server (httpd). When processing the list parameters for a post request, the value is directly written with sprintf to a local variable placed on the stack, which overrides the return address of the function, causing a buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-02/Tenda.md; https://github.com/zsjevilhex/iot/blob/master/route/tenda/tenda-02/Tenda.md
CVE: CVE-2018-14980
Published: 2019-04-25
Description: The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by ASUS or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage (i.e., sdcard). The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://www.kryptowire.com; https://www.kryptowire.com/portal/android-firmware-defcon-2018/; https://www.kryptowire.com
CVE: CVE-2018-14983
Published: 2019-04-25
Description: The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/[PII_REDACTED]:user/release-keys contains the android framework (i.e., system_server) with a package name of android (versionCode=24, versionName=7.0) that has been modified by Sony or another entity in the supply chain. The system_server process in the core android package has an exported broadcast receiver that allows any app co-located on the device to programmatically initiate the taking of a screenshot and have the resulting screenshot be written to external storage. The taking of a screenshot is not transparent to the user; the device has a screen animation as the screenshot is taken and there is a notification indicating that a screenshot occurred. If the attacking app also requests the EXPAND_STATUS_BAR permission, it can wake the device up using certain techniques and expand the status bar to take a screenshot of the user's notifications even if the device has an active screen lock. The notifications may contain sensitive data such as text messages used in two-factor authentication. The system_server process that provides this capability cannot be disabled, as it is part of the Android framework. The notification can be removed by a local Denial of Service (DoS) attack to reboot the device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.kryptowire.com; https://www.kryptowire.com/portal/android-firmware-defcon-2018/; https://www.kryptowire.com
CVE: CVE-2018-14989
Published: 2019-04-25
Description: The Plum Compass Android device with a build fingerprint of PLUM/c179_hwf_221/c179_hwf_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains a pre-installed platform app with a package name of com.android.settings (versionCode=23, versionName=6.0-eng.root.20[PII_REDACTED]55) that contains an exported broadcast receiver app component which allows any app co-located on the device to programmatically perform a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.kryptowire.com; https://www.kryptowire.com/portal/android-firmware-defcon-2018/; https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
CVE: CVE-2018-14990
Published: 2019-04-25
Description: The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20[PII_REDACTED]28:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14[PII_REDACTED]A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with a broadcast receiver app component named com.suntek.mway.rcs.app.test.TestReceiver and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a broadcast receiver app component named com.rcs.gsma.na.test.TestReceiver allow any app co-located on the device to programmatically send text messages where the number and body of the text message is controlled by the attacker due to an exported broadcast receiver app component. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. A separate vulnerability in the app allows a zero-permission app to programmatically delete text messages, so the sent text messages can be removed to not alert the user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.kryptowire.com; https://www.kryptowire.com/portal/android-firmware-defcon-2018/; https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
CVE: CVE-2018-14991
Published: 2019-04-25
Description: The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20[PII_REDACTED]28:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14[PII_REDACTED]A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with an exported content provider named com.suntek.mway.rcs.app.service.provider.message.MessageProvider and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a content provider named com.rcs.gsma.na.provider.message.MessageProvider allow any app co-located on the device to read, write, insert, and modify the user's text messages. This is enabled by an exported content provider app component that serves as a wrapper to the official content provider that contains the user's text messages. This app cannot be disabled by the user and the attack can be performed by a zero-permission app.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.kryptowire.com; https://www.kryptowire.com/portal/android-firmware-defcon-2018/; https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf
CVE: CVE-2018-14993
Published: 2019-04-25
Description: The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZW_ASUS_A009/ASUS_A009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the Asus ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys both contain a pre-installed platform app with a package name of com.asus.splendidcommandagent (versionCode=[PII_REDACTED], versionName=1.2.0.18_160928) that contains an exported service named com.asus.splendidcommandagent.SplendidCommandAgentService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, obtain the user's text messages, and more.
CVSS Score: 7.8 (HIGH)
References: https://www.kryptowire.com; https://www.kryptowire.com/portal/android-firmware-defcon-2018/; https://www.kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf