🚨 CVE-2024-33786
An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code via uploading a crafted file.

🎖@cveNotify

🚨 CVE-2024-33787
Hengan Weighing Management Information Query Platform 2019-2021 53.25 was discovered to contain a SQL injection vulnerability via the tuser_Number parameter at search_user.aspx.

🎖@cveNotify

🚨 CVE-2023-41816
An improper export vulnerability was reported in the Motorola Services Main application that could allow a local attacker to write to a local database.

🎖@cveNotify

🚨 CVE-2023-41817
An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information.

🎖@cveNotify

🚨 CVE-2023-41818
An improper use of the SD card for sensitive data vulnerability was reported in the Motorola Device Help application that could allow a local attacker to read system logs.

🎖@cveNotify

🚨 CVE-2023-41819
A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content providers.

🎖@cveNotify

🚨 CVE-2023-41820
An implicit intent vulnerability was reported in the Motorola Ready For application that could allow a local attacker to read information about connected Bluetooth audio devices.

🎖@cveNotify

🚨 CVE-2023-41821
A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information.

🎖@cveNotify

🚨 CVE-2023-41822
An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands.

🎖@cveNotify

🚨 CVE-2023-41823
An improper export vulnerability was reported in the Motorola Phone Extension application, that could allow a local attacker to execute unauthorized Activities.

🎖@cveNotify

🚨 CVE-2023-41824
An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data.

🎖@cveNotify

🚨 CVE-2023-41825
A path traversal vulnerability was reported in the Motorola Ready For application that could allow a local attacker to access local files.

🎖@cveNotify

🚨 CVE-2023-41826
A PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or interact with non-exported software components without permission.

🎖@cveNotify

🚨 CVE-2023-41828
An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exported content provider.

🎖@cveNotify

🚨 CVE-2023-41830
An improper absolute path traversal vulnerability was reported for the Ready For application allowing a local application access to files without authorization.

🎖@cveNotify

🚨 CVE-2023-6363
Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.
This issue affects Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.

🎖@cveNotify

🚨 CVE-2024-1067
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. On Armv8.0 cores, there are certain combinations of the Linux Kernel and Mali GPU kernel driver configurations that would allow the GPU operations to affect the userspace memory of other processes.
This issue affects Bifrost GPU Kernel Driver: from r41p0 through r47p0; Valhall GPU Kernel Driver: from r41p0 through r47p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.

🎖@cveNotify

🚨 CVE-2024-1395
Use After Free vulnerability in Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.
This issue affects Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r47p0.

🎖@cveNotify

🚨 CVE-2024-3108
An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization.

🎖@cveNotify

🚨 CVE-2022-48670
In the Linux kernel, the following vulnerability has been resolved:

peci: cpu: Fix use-after-free in adev_release()

When auxiliary_device_add() returns an error, auxiliary_device_uninit()
is called, which causes refcount for device to be decremented and
.release callback will be triggered.

Because adev_release() re-calls auxiliary_device_uninit(), it will cause
use-after-free:
[ 1269.455172] WARNING: CPU: 0 PID: 14267 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15
[ 1269.464007] refcount_t: underflow; use-after-free.

🎖@cveNotify

🚨 CVE-2022-1415
A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.

🎖@cveNotify