CVE-2022-30747

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

CVE-2022-30747

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

CVE-2022-30745

Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share...

CVE-2022-30731

Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application...

Improper access control

Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application...

CVE-2022-30747: Incorrect Default Permissions

PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent...

PT-2022-20269 · M Files · My Files

Name of the Vulnerable Software and Affected Versions: My Files versions prior to 13.1.00.193 Description: The issue is related to improper access control in the My Files application, allowing attackers to access arbitrary private files. Recommendations: For versions prior to 13.1.00.193, update ...

CVE-2022-24840: Improper Limitation of a Pathname to a Restricted Directory

django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and in most cases to access or delete files. If the AWSLOCATION setting was set, traversal was limited to that location only. The issue was...

The vulnerability of the TrueConf Server software lies in the possibility of bypassing the path in the script /handlers/get-img-file.php, allowing an attacker to access arbitrary files.

The vulnerability of the TrueConf Server software is related to the possibility of bypassing the path in the script /handlers/get-img-file.php. Exploiting this vulnerability allows a malicious actor to gain access to arbitrary files...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, a U.S. company. Google Android is vulnerable to an information disclosure vulnerability caused by the presence of an obfuscated agent in the uploadFile function in FileUploadServiceImpl.java that leads to incorrect file...

Fedora: Security Advisory for fapolicyd (FEDORA-2022-47a86f6258)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-32271

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary loca...

[SECURITY] Fedora 35 Update: fapolicyd-1.1.2-1.fc35

Fapolicyd File Access Policy Daemon implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applications are not. The daemon makes use of the kernel's fanotify interface to determine file access rights...

[SECURITY] Fedora 36 Update: fapolicyd-1.1.2-1.fc36

Fapolicyd File Access Policy Daemon implements application whitelisting to decide file access rights. Applications that are known via a reputation source are allowed access while unknown applications are not. The daemon makes use of the kernel's fanotify interface to determine file access rights...

PT-2022-11735 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1200T version 4.1.2cu.5215 Description: The issue concerns a remote command injection vulnerability. This vulnerability is located in the NTPSyncWithHost function of the system.so file, allowing control over hostTime to launch an...

CVE-2022-32271: Improper Neutralization of Input During Web Page Generation

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary loca...

CVE-2021-33473

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verifyurl option is disabled. This vulnerability is exploited via a crafted URL...

PT-2022-10265 · Unknown · Dragonfly Ruby Gem

Name of the Vulnerable Software and Affected Versions: Dragonfly Ruby Gem version 1.3.0 Description: An argument injection issue allows attackers to read and write arbitrary files when the verify url option is disabled. This issue is exploited via a crafted URL. Recommendations: For Dragonfly Rub...

CVE-2021-33473: Improper Neutralization of Argument Delimiters in a Command

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verifyurl option is disabled. This vulnerability is exploited via a crafted URL...

PUB-A-211757677

In uploadFile of FileUploadServiceImpl.java, there is a possible incorrect file access due to a confused deputy. This could lead to local information disclosure of private files with no additional execution privileges needed. User interaction is not needed for exploitation...