279 matches found
CVE-2021-1005
In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User...
CVE-2021-0990
In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction ...
USN-5115-1: Linux kernel (OEM) vulnerabilities
It was discovered that a race condition existed in the Atheros Ath9k WiFi driver in the Linux kernel. An attacker could possibly use this to expose sensitive information WiFi network traffic. CVE-2020-3702 Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF...
Advantech R-SeeNet device_graph_page.php Multiple Reflected XSS vulnerabilities
Summary Multiple cross-site scripting vulnerabilities exist in the devicegraphpage.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. If a user visits specially crafted URLs, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An...
kernel: information exposure in drivers/char/random.c and kernel/time/timer.c
A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. The highest threat from this vulnerability is to data confidentiality...
Unspecified Vulnerability in BASETech GE-131 BT-1837836
The BASETech GE-131 BT-1837836 is a Wi-Fi IP CCTV camera. The BASETech GE-131 BT-1837836 suffers from a device ID predictability vulnerability. An attacker can exploit this vulnerability to connect to the device...
CVE-2020-27556
A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device...
CVE-2020-27556
A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device...
Code injection
A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device...
CVE-2020-27556
A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device...
CVE-2020-27556
The CVE-2020-27556 entry concerns BASETech GE-131 BT-1837836 Wi‑Fi IP CCTV camera firmware 20180921, where a predictable device ID enables unauthenticated remote connection to the device. This is corroborated by NVD, RH, CNVD-style entries in the connected documents. No specific exploit details o...
Basetech Ge-131 Bt-1837836 安全漏洞
The BASETech GE-131 BT-1837836 is a Wi-Fi IP CCTV camera. The BASETech GE-131 BT-1837836 suffers from a device ID predictability vulnerability. An attacker can exploit this vulnerability to connect to the device...
kernel: information exposure in drivers/char/random.c and kernel/time/timer.c
A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. The highest threat from this vulnerability is to data confidentiality...
Advantech R-SeeNet device_position device_id SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech R-SeeNet. Authentication is not required to exploit this vulnerability. The specific flaw exists within deviceposition.php. When parsing the deviceid parameter, the process does not...
CVE-2020-16166
A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. The highest threat from this vulnerability is to data confidentiality. Mitigation Mitigation for this issue is either not available or the currently available options dont mee...
CVE-2020-13637
An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the clientkey, the deviceid, and the public key for end-to-end encryption in cleartext, enabling an attacker by copying or having access to the local storage databas...
CVE-2020-13129
An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms. The GET method is used with clientkey and deviceid data in the query string, which allows attackers to obtain sensitive information by reading web-server logs...
CVE-2016-5202
browser/extensions/api/dial/dialregistry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase call, which causes the erase operation to access data that that erase operation will destroy...
CVE-2016-5202
browser/extensions/api/dial/dialregistry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase call, which causes the erase operation to access data that that erase operation will destroy...
