‼ CVE-2021-41413 ‼
📖 Read
via "National Vulnerability Database".
ok-file-formats master 2021-9-12 is affected by a buffer overflow in ok_jpg_convert_data_unit_grayscale and ok_jpg_convert_YCbCr_to_RGB.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39691 ‼
📖 Read
via "National Vulnerability Database".
In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-157929241📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2086 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in SourceCodester Bank Management System 1.0. Affected by this issue is login.php. The manipulation of the argument password with the input 1'and 1=2 union select 1,sleep(10),3,4,5 --+ leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20125 ‼
📖 Read
via "National Vulnerability Database".
In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-194402515📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20135 ‼
📖 Read
via "National Vulnerability Database".
In writeToParcel of GateKeeperResponse.java, there is a possible parcel format mismatch. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-220303465📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20129 ‼
📖 Read
via "National Vulnerability Database".
In registerPhoneAccount of PhoneAccountRegistrar.java, there is a possible way to prevent the user from selecting a phone account due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-217934478📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20124 ‼
📖 Read
via "National Vulnerability Database".
In deletePackageX of DeletePackageHelper.java, there is a possible way for a Guest user to reset pre-loaded applications for other users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-170646036📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20134 ‼
📖 Read
via "National Vulnerability Database".
In readArguments of CallSubjectDialog.java, there is a possible way to trick the user to call the wrong phone number due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-218341397📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20133 ‼
📖 Read
via "National Vulnerability Database".
In setDiscoverableTimeout of AdapterService.java, there is a possible bypass of user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-206807679📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20127 ‼
📖 Read
via "National Vulnerability Database".
In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221862119📖 Read
via "National Vulnerability Database".
‼ CVE-2022-2087 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, was found in SourceCodester Bank Management System 1.0. This affects the file /mnotice.php?id=2. The manipulation of the argument notice with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20131 ‼
📖 Read
via "National Vulnerability Database".
In nci_proc_rf_management_ntf of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221856662📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20130 ‼
📖 Read
via "National Vulnerability Database".
In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-224314979📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20123 ‼
📖 Read
via "National Vulnerability Database".
In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-221852424📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20126 ‼
📖 Read
via "National Vulnerability Database".
In setScanMode of AdapterService.java, there is a possible way to enable Bluetooth discovery mode without user interaction due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-203431023📖 Read
via "National Vulnerability Database".
🗓️ Dark web awash with breached credentials, study finds 🗓️
📖 Read
via "The Daily Swig".
Many consumers still relying on easy-to-crack passwords, warns Digital Shadows📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Dark web awash with breached credentials, study finds
Many consumers still relying on easy-to-crack passwords, warns Digital Shadows
‼ CVE-2022-20181 ‼
📖 Read
via "National Vulnerability Database".
Product: AndroidVersions: Android kernelAndroid ID: A-210936609References: N/A📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33036 ‼
📖 Read
via "National Vulnerability Database".
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20156 ‼
📖 Read
via "National Vulnerability Database".
In unflatten of GraphicBuffer.cpp, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-212803946References: N/A📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20170 ‼
📖 Read
via "National Vulnerability Database".
Product: AndroidVersions: Android kernelAndroid ID: A-209421931References: N/A📖 Read
via "National Vulnerability Database".
‼ CVE-2022-20176 ‼
📖 Read
via "National Vulnerability Database".
In auth_store of sjtag-driver.c, there is a possible read of uninitialized memory due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-197787879References: N/A📖 Read
via "National Vulnerability Database".