5920 matches found
How to use AWS Resource Control Policies
Unlock the Power of AWS Resource Control Policies: Enforce Security and Streamline Governance Across Your Organization...
SUSE CVE-2024-30896
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and...
CVE-2018-9374
CVE-2018-9374 affects Android’s PackageManagerService.java, specifically installPackageLI, enabling a possible permissions bypass that could lead to local elevation of privilege. Exploitation would require local user privileges with no user interaction, per the CVE description. The issue is liste...
CVE-2018-9354
CVE-2018-9354 is a vulnerability in the Android VideoFrameScheduler component: in VideoFrameScheduler.cpp, PLL::fit can trigger a divide-by-zero error leading to a remote denial of service. Multiple connected records confirm the affected area but do not provide concrete patch/version details or a...
CVE-2018-9353
CVE-2018-9353 affects the ihevcd_parse_slice_data function in ihevcd_parse_slice.c used by Google Android. The root cause is a missing bounds check that enables a heap buffer out-of-bounds read, allowing remote denial of service with no single execution privilege required. Exploitation requires u...
CVE-2018-9352
CVE-2018-9352 affects the ihevcd_allocate_dynamic_bufs function in ihevcd_api.c. The vulnerability is a resource exhaustion due to an integer overflow, potentially enabling remote denial of service with no code execution required. Exploitation requires user interaction. Connected sources (Red Hat...
CVE-2018-9350
CVE-2018-9350 describes a vulnerability in ih264d_assign_pic_num (ih264d_utils.c) where a missing bounds check can cause an out-of-bounds read, resulting in a denial of service. The issue is triggered by user interaction and would be exploitable remotely via the affected component, as indicated b...
CVE-2018-9349
CVE-2018-9349 describes an out-of-bounds read in the mv_err_cost function of mcomp.c, leading to denial of service with no additional privileges. Exploitation requires user interaction. The available documents do not specify affected products/versions or a patched release; no concrete remediation...
CVE-2017-13323
CVE-2017-13323 is a Google/Android elevation-of-privilege flaw caused by an out-of-bounds write in String16.cpp due to an integer overflow. The Red Hat and CNVD entries restate the issue; Android/Pixel bulletin notes this CVE as EoP (Moderate) and indicates patches are included in the 2018-05-05 ...
CVE-2017-13321
The CVE-2017-13321 issue affects Android’s SensorService::isDataInjectionEnabled in frameworks/native/services/sensorservice/SensorService.cpp, where a missing bounds check can cause an out-of-bounds read. This leads to local information disclosure with no user interaction and without additional ...
CVE-2017-13320
CVE-2017-13320 affects libmpeg2dec, specifically the impeg2d_bit_stream_flush() function, where a missing bounds check can cause an out-of-bounds read. This leads to a remote denial-of-service possibility with no different privileges required; exploitation requires user interaction. Public source...
CVE-2017-13319
CVE-2017-13319 is a buffer overread in the Android Media framework (pvmp3_get_main_data_size) that can lead to remote information disclosure without user interaction. The Android Pixel/Nexus bulletin lists CVE-2017-13319 under Media framework with updated AOSP versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1...
APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor. That's according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google...
CVE-2024-52323
Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account...
No Fuss Computing Centurion ERP 安全漏洞
No Fuss Computing Centurion ERP is an open source enterprise resource planning ERP software from No Fuss Computing. A security vulnerability exists in No Fuss Computing Centurion ERP versions prior to 1.3.1, which originated when an authenticated user with work order viewing privileges could view...
CVE-2017-18307
CVE-2017-18307 is linked to Qualcomm chipsets (notably qcacld-3.0) and is described as an information-disclosure vulnerability that can occur during audio playback. The Red Hat and CVE listings corroborate an information leak, with Qualcomm’s product-security notes showing a local attack vector a...
CVE-2017-18306
CVE-2017-18306 refers to an information disclosure in Qualcomm’s camera subsystem (v4l2) within the Snapdragon/Qualcomm components due to an uninitialized variable. The Red Hat and NVD records confirm a local-access information exposure with a high confidentiality impact; the CVE is cataloged und...
CVE-2016-10408
CVE-2016-10408 affects Qualcomm QSEE. Red Hat and NVD entries describe a vulnerability where QSEE may randomly experience a fatal error during execution due to speculative instruction fetches from device memory (memory region not valid executable memory). This is a local issue with a high impact ...
CVE-2023-0163
CVE-2023-0163 applies to Mozilla Convict prior to 6.2.4, describing a prototype pollution flaw that allows an attacker to modify object prototype attributes or inject attributes used elsewhere, potentially leading to a crash. The vulnerability affects server-side configuration handling by admins ...