CVE-2023-44127

CVE-2023-44127 involves LG-patched call management (com.android.server.telecom). The issue is that it launches implicit intents which disclose sensitive data (e.g., contact details and phone numbers) to all third-party apps on the same device. Exploitation details are not provided in the document...

CVE-2023-44126 Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...

CVE-2023-44126 Call management - Implicit intents disclose telephony data such as phone numbers, call states, contacts

The vulnerability is that the Call management "com.android.server.telecom" app patched by LG sends a lot of LG-owned implicit broadcasts that disclose sensitive data to all third-party apps installed on the same device. Those intents include data such as call states, durations, called numbers,...

(0Day) Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw exists within the dnszoneeditor module. The issue results from the lack of proper validation of a...

PT-2023-29120 · Google · Com.Android.Server.Telecom

Name of the Vulnerable Software and Affected Versions: com.android.server.telecom affected versions not specified Description: The issue is related to the Call management app patched by LG, which sends numerous LG-owned implicit broadcasts. These broadcasts disclose sensitive data, including call...

PT-2023-29121 · Google · Com.Android.Server.Telecom

Name of the Vulnerable Software and Affected Versions: com.android.server.telecom affected versions not specified Description: The issue is related to the Call management app patched by LG, which launches implicit intents that disclose sensitive data to all third-party apps installed on the same...

(0Day) Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw exists within the mysqlmanager module. The issue results from the lack of proper validation of a...

(0Day) Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cwpsrv process...

CVE-2023-4753

OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input...

CVE-2023-4753

OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input...

Input validation

OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input...

CVE-2023-4753

CVE-2023-4753 concerns OpenHarmony: v3.2.1 and earlier are affected by a system call function usage error in the liteos-a kernel. The vulnerability can cause a local attacker to crash the kernel via malformed input, per the NVD description. Connected sources corroborate the OpenHarmony context an...

CVE-2023-4753 OpenHarmony v3.2.1 and prior version has a system call function usage error

OpenHarmony v3.2.1 and prior version has a system call function usage error. Local attackers can crash kernel by the error input...

PT-2023-30489 · Unknown +1 · Openharmony +1

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions 3.2.1 and prior Description: The issue is related to a system call function usage error and an mqueue undetected entries vulnerability in the liteos-a kernel. Local attackers can crash the kernel by providing error input...

GHSA-C647-PXM2-C52W Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

Impact In certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. - For rawcall, the argument buffer of the call can be corrupted, leading to incorrect calldata in the sub-context. - For createfromblueprint and createcopyof, the buffer f...

CVE-2023-43477

The pingfrom parameter of pingtracerte.cgi in the web UI of Telstra Smart Modem Gen 2 Arcadyan LH1000, firmware versions 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device...

Command injection

The pingfrom parameter of pingtracerte.cgi in the web UI of Telstra Smart Modem Gen 2 Arcadyan LH1000, firmware versions 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device...

CVE-2023-43477 Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)

The pingfrom parameter of pingtracerte.cgi in the web UI of Telstra Smart Modem Gen 2 Arcadyan LH1000, firmware versions 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device...

CVE-2023-43477 Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)

The pingfrom parameter of pingtracerte.cgi in the web UI of Telstra Smart Modem Gen 2 Arcadyan LH1000, firmware versions 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device...

PYSEC-2023-306

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In version 0.3.9 and prior, under certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. For rawcall, the argument buffer of the call can be corrupted,...