Unrated
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
CVE-2020-10993
First seen on SecPulse
References
- report github.com