CVE-2023-40127

In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40127

CVE-2023-40127 is an Android information-disclosure issue affecting the MediaProvider component across multiple locations. It arises from a confused deputy scenario, allowing local information disclosure with no additional execution privileges and without user interaction. The NVD entry notes a l...

PT-2023-27287 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX affected versions not specified Description: The issue is related to a confused deputy in the applyCustomDescription function of SaveUi.java, allowing an attacker to view another user's images. This could lead to local information...

PT-2023-27288 · Google · Android

Name of the Vulnerable Software and Affected Versions: DialogFillUi.java affected versions not specified Description: The issue is related to a confused deputy in the setHeader of DialogFillUi.java, allowing an attacker to view another user's images. This could lead to local information disclosur...

PT-2023-27291 · Fillui · Fillui

Name of the Vulnerable Software and Affected Versions: FillUi affected versions not specified Description: The issue in FillUi.java allows for local information disclosure due to a confused deputy, enabling the viewing of another user's images without requiring additional execution privileges or...

PT-2023-27289 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software name or versions are mentioned in the provided descriptions. Description: The issue is related to a confused deputy in multiple functions, potentially allowing an attacker to view another user's images. This could lead to...

PT-2023-27290 · Fillui · Fillui

Name of the Vulnerable Software and Affected Versions: FillUi affected versions not specified Description: The issue in FillUi allows an attacker to view another user's images due to a confused deputy, potentially leading to local information disclosure without requiring additional execution...

PT-2023-27278 · Google · Android

Name of the Vulnerable Software and Affected Versions: PipMenuView.java affected versions not specified Description: The issue is related to a possible bypass of a multi-user security boundary due to a confused deputy in the updateActionViews of PipMenuView.java. This could lead to local...

PT-2023-27286 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software name or version is mentioned in the provided descriptions. Description: The issue is related to a confused deputy in the isFullScreen function of FillUi.java, which could allow viewing another user's images. This leads to...

PT-2023-27285 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software name or versions are mentioned in the provided descriptions. Description: The issue is related to a confused deputy in multiple locations, potentially allowing an attacker to view another user's images. This could lead to...

PT-2023-27280 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a confused deputy, allowing access to screenshots in multiple locations. This could lead to local information disclosure without...

ASB-A-262244882

In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-42450

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2023-42450

Mastodon (ActivityPub-based) is affected in versions up to 4.2.0-rc2 where crafting specific input can inject arbitrary data into HTTP requests issued by the server. The issue enables confused deputy attacks if ALLOWED_PRIVATE_ADDRESSES permits access to local exploitable services. A patch exists...

CVE-2023-42450 Mastodon Server-Side Request Forgery vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

SUSE SLES12 Security Update : kernel (Live Patch 40 for SLE 12 SP5) (SUSE-SU-2023:3582-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3582-1 advisory. This update for the Linux Kernel 4.12.14-122150 fixes several issues. The following security issues were fixed: - CVE-2023-3567: Fixed a...

CVE-2023-35682

In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2023-35680

In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-35682

In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2023-35680

In multiple locations, there is a possible way to import contacts belonging to other users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...