Nextcloud: External Storage - WebDAV - New user has access to storage from deleted user (same user-ID)

Delete existing user account "user3" Create new user account "user3" Also reported on https://github.com/nextcloud/server/issues/15258 Impact Newly created user with same user-id of a deleted user has access to the configured external webdav storage from the deleted user...

CVE-2018-14980: Incorrect Permission Assignment for Critical Resource

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys contains the android framework i.e., systemserver with a package name of android versionCode=24, versionName=7.0 that has been modified by ASUS or...

CVE-2018-14983: Improper Input Validation

The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework i.e., systemserver with a package name of android versionCode=24, versionName=7.0 that has been modified by Sony or another entity in the supp...

CVE-2018-19589

Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...

Design/Logic Flaw

Incorrect Access Controls of Security Officer SO in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticated to a slot to retrieve attributes of keys marked as private keys in external key storage, and also delete keys marked as private keys in...

The vulnerability of the libvirt virtualization management package in the Astra Linux operating system, which allows a hacker to trigger a service failure

The vulnerability of the libvirt virtualization management package in the Astra Linux operating system is related to the incorrect assignment of token labels to external file storage systems with integrity control tokens enabled. Exploiting this vulnerability could allow an attacker to cause a...

CVE-2018-18812

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when th...

Design/Logic Flaw

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when th...

CVE-2018-18812

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when th...

CVE-2018-18812: Incorrect Permission Assignment for Critical Resource

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when th...

CVE-2018-14995

The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/release-keys, the ZTE Blade Spark Android device with a build fingerprint of ZTE/Z971/peony:7.1.1/NMF26V/20171129.143111:user/release-keys, the ZTE ZMAX Pro Android device with a buil...

CVE-2018-14979

The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/USPhone/ASUSX0081:7.0/NRD90M/USPhone-14.14.1711.92-20171208:user/release-keys contains a pre-installed app with a package name of com.asus.loguploader versionCode=1570000275, versionName=7.0.0.55170515. This app contains an...

CVE-2018-15004

The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode versionCode=24, versionName=7.0 that contains an exported service app component named...

Design/Logic Flaw

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.bsptest versionCode=1, versionName=1.0 containing an exported activity app component named com.vivo.bsptest.BSPTestActivity...

CVE-2018-15001

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.bsptest versionCode=1, versionName=1.0 containing an exported activity app component named com.vivo.bsptest.BSPTestActivity...

CVE-2018-15001

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name of com.vivo.bsptest versionCode=1, versionName=1.0 containing an exported activity app component named com.vivo.bsptest.BSPTestActivity...

CVE-2018-15002

The Vivo V7 device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys allows any app co-located on the device to set system properties as the com.android.phone user. The com.qualcomm.qti.modemtestmode app versionCode=25, versionName=7.1.2 that contains an...

PT-2018-12856

Name of the Vulnerable Software and Affected Versions ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US Phone/ASUS X008 1:7.0/NRD90M/US Phone-14.14.1711.92-20171208:user/release-keys com.asus.loguploader version 7.0.0.55 170515 Description The pre-installed app...

PT-2018-12868

Name of the Vulnerable Software and Affected Versions Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys Description The issue allows any app co-located on the device to initiate the writing of the logcat log, bluetooth log, and kernel...

CVE-2018-6599

An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing attackers to obtain sensitive information such as text-message content by reading a copy of the Android log on the SD card. The system-wide Android logs are not directly available ...