‼ CVE-2023-21362 ‼
📖 Read
via "National Vulnerability Database".
In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21361 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Bluetooth process with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36920 ‼
📖 Read
via "National Vulnerability Database".
In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-FRAME-OPTIONS response header is not implemented, allowing an unauthenticated attacker to attempt clickjacking, which could result in disclosure or modification of information.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21356 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21348 ‼
📖 Read
via "National Vulnerability Database".
In Window Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21359 ‼
📖 Read
via "National Vulnerability Database".
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21337 ‼
📖 Read
via "National Vulnerability Database".
In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21334 ‼
📖 Read
via "National Vulnerability Database".
In App Ops Service, there is a possible disclosure of information about installed packages due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21339 ‼
📖 Read
via "National Vulnerability Database".
In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21338 ‼
📖 Read
via "National Vulnerability Database".
In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21341 ‼
📖 Read
via "National Vulnerability Database".
In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21335 ‼
📖 Read
via "National Vulnerability Database".
In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21332 ‼
📖 Read
via "National Vulnerability Database".
In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21336 ‼
📖 Read
via "National Vulnerability Database".
In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
🦿 White House Executive Order on AI Provides Guidelines for AI Privacy and Safety 🦿
📖 Read
via "Tech Republic".
The Biden administration directed government organizations, including NIST, to encourage responsible and innovative use of generative AI.📖 Read
via "Tech Republic".
TechRepublic
AI Executive Order: White House Releases 90-Day Progress Report
The Biden administration directed government organizations, including NIST, to encourage responsible and innovative use of AI.
🕴 Boeing Breached by Ransomware, LockBit Gang Claims 🕴
📖 Read
via "Dark Reading".
LockBit gives Boeing a Nov. 2 deadline to pay the ransom, or have its sensitive documents leaked to the public, but it hasn't given evidence of the compromise. 📖 Read
via "Dark Reading".
Dark Reading
Boeing Breached by Ransomware, LockBit Gang Claims
LockBit gives Boeing a Nov. 2 deadline to pay the ransom or have its sensitive documents leaked to the public, but it hasn't given evidence of the compromise.
🕴 UAE Cyber Council Warns of Google Chrome Vulnerability 🕴
📖 Read
via "Dark Reading".
The country has issued a recommendation to update after a high-risk vulnerability was disclosed last week in the browser.📖 Read
via "Dark Reading".
Dark Reading
UAE Cyber Council Warns of Google Chrome Vulnerability
The country has issued a recommendation to update after a high-risk vulnerability was disclosed last week in the browser.
🕴 Budget Cuts at CISA Could Affect Enterprise Cybersecurity 🕴
📖 Read
via "Dark Reading".
Politicians are suggesting massive cuts to CISA's budget, threatening its missions to secure federal networks and help critical infrastructure operators fend off cyberattacks.📖 Read
via "Dark Reading".
Dark Reading
Budget Cuts at CISA Could Affect Enterprise Cybersecurity
Politicians are suggesting massive cuts to CISA's budget, threatening its missions to secure federal networks and help critical infrastructure operators fend off cyberattacks.
‼ CVE-2023-40101 ‼
📖 Read
via "National Vulnerability Database".
In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-47104 ‼
📖 Read
via "National Vulnerability Database".
tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21385 ‼
📖 Read
via "National Vulnerability Database".
In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.📖 Read
via "National Vulnerability Database".