CVE-2023-21173

CVE-2023-21173 affects Android 13 where multiple methods in DataUsageList.java can reveal admin network activity due to a missing permission check, enabling local information disclosure with no extra privileges or user interaction. The vulnerability is documented across multiple feeds (NVD, Red H...

CVE-2023-21518

Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity...

CVE-2023-21518

Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google, an American company. Google Pixel suffers from a security vulnerability that stems from the presence of missing permission checks in multiple methods of the DataUsageList.java file, with a possible way to learn about the network activity of an administrat...

CVE-2023-29459

The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary...

CVE-2023-29459

The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary...

Information disclosure

The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary...

OpenSSH trojan campaign targets Linux systems and IoT devices

Poorly configured Linux and Internet of Things IoT devices are at risk of compromise from a cryptojacking campaign, according to researchers at Microsoft. The attacks, which involve brute forcing a way into a system, are designed to profit from mining in illicit fashion for cryptocurrency. Once t...

CVE-2023-29459

The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI is subsequently loaded into the application's webview, thus allowing the loading of arbitrary...

PT-2023-22267 · Red Bull · Laola.Redbull

Name of the Vulnerable Software and Affected Versions: laola.redbull application through 5.1.9-R for Android Description: The laola.redbull application exposes the exported activity at.redbullsalzburg.android.AppMode.Default.Splash.SplashActivity, which accepts a data: URI. The target of this URI...

Malicious code in cypress-typed-stubs-example-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d06bdef719edee1677bda9a46ae9d713bed145fb60b910c15f7260b2fca5b18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mesos-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ca86e4f7655ee05071ef73a17f239df8dcc483b932ef71d351cf47e8435376b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babar-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d799f6658deb9ee8f4827e581daad241c2e6c6a67633932b0247ca17fca4bf0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-120 Malicious code in babar-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d799f6658deb9ee8f4827e581daad241c2e6c6a67633932b0247ca17fca4bf0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1254 Malicious code in nowyouseereact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9bbe52aafd9e6d0b2e3a3833f5648c9f6e2420d6bec841c56a6e5163478befce The OpenSSF Package Analysis project identified 'nowyouseereact' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1272 Malicious code in proteus-demo-app-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 14233d3bcebc4fe93545aca56d7d71ce365fcff59f4bf288232269a8e1669df6 The OpenSSF Package Analysis project identified 'proteus-demo-app-server' @ 10.0.1 npm as malicious. It is considered malicious because: - The...

New Cryptocurrency Mining Campaign Targets Linux Systems and IoT Devices

Internet-facing Linux systems and Internet of Things IoT devices are being targeted as part of a new campaign designed to illicitly mine cryptocurrency. "The threat actors behind the attack use a backdoor that deploys a wide array of tools and components such as rootkits and an IRC bot to steal...

MAL-2023-1123 Malicious code in bespin_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef9b9b100a28794dac4e539e7cc5f0b10522ca0838eeb49f5c78e02b754df4e2 The OpenSSF Package Analysis project identified 'bespinserver' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in bespin_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef9b9b100a28794dac4e539e7cc5f0b10522ca0838eeb49f5c78e02b754df4e2 The OpenSSF Package Analysis project identified 'bespinserver' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1339 Malicious code in vymo-jsevaluator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 043529532706257e33267bd81302d8dbf55ac5d275567919f6d62991806ba6e2 The OpenSSF Package Analysis project identified 'vymo-jsevaluator' @ 50.20.0 npm as malicious. It is considered malicious because: - The package...