ASB-A-154934934

In requestCellInfoUpdateInternal of PhoneInterfaceManager.java, there is a missing permission check. This could lead to local information disclosure of location data with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-151095863

In getDocumentMetadata of DocumentsContract.java, there is a possible disclosure of location metadata from a file due to a permissions bypass. This could lead to local information disclosure from a file eg. a photo containing location metadata with no additional execution privileges needed. User...

ICSA-20-212-02_Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.3 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: Mitsubishi Electric, Multiple Factory Automation Engineering Software products Vulnerability: Permission Issues 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update...

rConfig SQL Injection Vulnerability (CNVD-2020-43137)

rConfig is an open source network configuration management utility . rConfig 3.9.5 version of the SQL injection vulnerability , a remote attacker can use the 'customLocation' parameter to send specially crafted SQL statements to the devices.crud.php script to exploit the vulnerability to view ,...

The vulnerability of the Windows Network Location Awareness Service allows attackers to escalate their privileges and execute arbitrary code.

The vulnerability of the Windows Network Location Awareness Service in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code through a specially created application...

CVE-2020-15714

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the customLocation parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database...

Images in Eye Reflections

In Japan, a cyberstalker located his victim by enhancing the reflections in her eye, and using that information to establish a location. Reminds me of the image enhancement scene in Blade Runner. That was science fiction, but now image resolution is so good that we have to worry about it...

About the security content of watchOS 3 - Apple Support

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, see the Apple Product Security...

CVE-2014-1422

In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in...

CVE-2014-1422

In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in...

Design/Logic Flaw

In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in...

CVE-2014-1422 Location service uses cached authorization even after revocation

In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in...

CVE-2014-1422

The CVE-2014-1422 issue affects Ubuntu’s trust-store component. It causes location permissions revocation to be ineffective because the cache of permissions is honored based on an incorrect ordering and not by creation time, due to the Select struct in src/core/trust/impl/sqlite3/store.cpp. Pract...

Microsoft OneDrive power-up vulnerability

Microsoft OneDrive is a cloud backup application from Microsoft USA. The program features automatic backup of photo albums, online office and file sharing. A power lifting vulnerability exists in Microsoft OneDrive. The vulnerability can be exploited by an attacker with the help of a specially...

Microsoft Windows Network Location Awareness Service Elevation of Privilege Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in the Microsoft Windows Network Location...

About the security content of tvOS 13.4.8

About the security content of tvOS 13.4.8 This document describes the security content of tvOS 13.4.8. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Microsoft Windows Multiple Vulnerabilities (KB4565524)

This host is missing a critical security update according to Microsoft KB4565524 SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-1437

An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka 'Windows Network Location Awareness Service Elevation of Privilege Vulnerability'...

CVE-2020-1437

An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka 'Windows Network Location Awareness Service Elevation of Privilege Vulnerability'...

CVE-2020-1437

CVE-2020-1437 is described in CNVD as an elevation-of-privilege vulnerability in the Windows Network Location Awareness Service. The flaw stems from how the service handles objects in memory, enabling an attacker to execute code with elevated privileges by running a specially crafted application....