Authorization Bypass

firefox is vulnerable to authorization bypass. The vulnerability exists as a flaw was found in the way Firefox presented the location bar to a user. A malicious website could trick a user into thinking they are visiting the site reported by the location bar, when the page is actually content...

The network location profile changes from "Domain" to "Public" in Windows 7 or in Windows Server 2008 R2

The network location profile changes from "Domain" to "Public" in Windows 7 or in Windows Server 2008 R2 Symptoms On a computer that is running Windows 7 or Windows Server 2008 R2, the network location profile that is selected changes unexpectedly from Domain to Public. Additionally, the firewall...

Windows Explorer stops responding if you try to expand a mapped drive in Windows 7 or in Windows Server 2008 R2

Windows Explorer stops responding if you try to expand a mapped drive in Windows 7 or in Windows Server 2008 R2 Symptoms Considering the following scenario: You have a mapped drive that connects to a shared network location on a computer that is running Windows 7 or Windows Server 2008 R2. Note T...

CVE-2018-21039

An issue was discovered on Samsung mobile devices with N7.0 software. With the Location permission for the compass feature in Quick Tools aka QuickTools, an attacker can bypass the lockscreen. The Samsung ID is SVE-2018-12053 December 2018...

CVE-2018-21039

CVE-2018-21039 affects Samsung mobile devices running Android 7.0 (Nougat). The issue arises when granting Location permission to the compass feature in Quick Tools/QuickTools, enabling a lockscreen bypass. Connected sources reiterate the vulnerability but do not provide detailed root-cause analy...

Clever Cryptography Could Protect Privacy in Covid-19 Contact-Tracing Apps

Researchers are racing to achieve the benefits of location-tracking without the surveillance...

CVE-2017-18673

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...

CVE-2017-18673

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...

Design/Logic Flaw

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...

CVE-2017-18673

CVE-2017-18673 affects Samsung mobile devices running N(7.x) software. The issue allows an attacker to disable the Location service on a locked device, preventing the rightful owner from locating a stolen device. The Samsung ID is SVE-2017-8524 (May 2017). Public documents do not provide details ...

CVE-2017-18673

An issue was discovered on Samsung mobile devices with N7.x software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 May 2017...

WHO COVID-19 Mobile App: Improper Input Validation on User's Location on PUT /WhoService/putLocation Could Affect Availability/Falsify Users

Summary: Note: I noticed that that the team has fixed issues like an XSS that's caused only from a header value typically OOS since it's not directly exploitable https://github.com/WorldHealthOrganization/app/pull/855, so in the spirit of this I'm also reporting another "good-to-fix" issue. On th...

How Just Visiting A Site Could Have Hacked Your iPhone or MacBook Camera

If you use an Apple iPhone or a MacBook, we have a piece of alarming news for you. Turns out merely visiting a website — not just malicious but also legitimate sites unknowingly loading malicious ads as well — using Safari browser could have let remote attackers secretly access your device's...

Directory Traversal

ansible is vulnerable to directory traversal. When extracting a collection of .tar.gz file, neither install nor the called extracttarfile performs any validation or sanitization of the filenames. This allows a malicious collection of .tar.gz file to be written in arbitrary location on the file...

Denial Of Service

LibreOffice is vulnerable to denail of service DoS. It is possible because of an insufficient URL encoding flaw in allowed script location check...

Telerik UI for Silverlight Path Traversal Vulnerability

Telerik UI for Silverlight is a suite of UI User Interface controls for application development from Telerik Bulgaria. A security vulnerability exists in Telerik UI for Silverlight versions prior to 2020.1.330. The vulnerability can be exploited by an attacker to upload a file to an arbitrary...

RHEL 7 : libreoffice (RHSA-2020:1151)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1151 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor...

kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS

A flaw was found in the Linux kernel’s implementation of the WiFi station handoff code. An attacker within the radio range could use this flaw to deny a valid device from joining the access point...

libreoffice: Unsafe URL assembly flaw in allowed script location check

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

libreoffice: Insufficient URL encoding flaw in allowed script location check

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...