OSV-2022-861 Heap-use-after-free in std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<geos::geom::Coor

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51083 Crash type: Heap-use-after-free READ 8 Crash state: std::1::pairstd::1::treeiteratorstd::1::valuetypegeos::geom::Coor geos::geomgraph::NodeMap::addNode geos::operation::overlay::OverlayOp::copyPoints...

geos:fuzz_geo2: Heap-use-after-free in std::__1::pair<std::__1::__tree_iterator<std::__1::__value_type<geos::geom::Coor

Detailed Report: https://oss-fuzz.com/testcase?key=6314252360613888 Project: geos Fuzzing Engine: libFuzzer Fuzz Target: fuzzgeo2 Job Type: libfuzzerasangeos Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6150004b9318 Crash State:...

UI REDRESSING

Description Clickjacking is a portmanteau of two words ‘click’ and ‘hijacking’. It refers to hijacking user’s click for malicious intent. In it, an attacker embeds the vulnerable site in an transparent iframe in attacker’s own website and overlays it with objects such as button using CSS skills...

Ubuntu: Security Advisory (USN-5011-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cybercriminals Developing BugDrop Malware to Bypass Android Security Features

In a sign that malicious actors continue to find ways to work around Google Play Store security protections, researchers have spotted a previously undocumented Android dropper trojan that's currently in development. "This new malware tries to abuse devices using a novel technique, not seen before...

SOVA Android Banking Trojan Returns With New Capabilities and Targets

The SOVA Android banking trojan is continuing to be actively developed with upgraded capabilities to target no less than 200 mobile applications, including banking apps and crypto exchanges and wallets, up from 90 apps when it started out. That's according to the latest findings from Italian...

CVE-2022-20331

In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2022-20331

In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

Privilege escalation

In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2022-20331

CVE-2022-20331 affects the Android 13 Framework. A tapjacking/overlay flaw can enable a work profile without user consent, causing local escalation of privilege. Exploitation requires user interaction but does not need extra execution privileges. CVSS v3.1 base score is High (7.8) with LOCAL atta...

PT-2022-14557 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue allows for a possible tapjacking/overlay attack, enabling a work profile without user consent. This could lead to local escalation of privilege with no additional execution...

CVE-2022-20331: Improper Restriction of Rendered UI Layers or Frames

In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions:...

CVE-2022-33723

A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33723

A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33727

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33723

A vulnerable code in onCreate of BluetoothScanDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

Code injection

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33727

A vulnerable code in onCreate of SecDevicePickerDialog prior to SMR Aug-2022 Release 1, allows attackers to trick the user to select an unwanted bluetooth device via tapjacking/overlay attack...

CVE-2022-33727

CVE-2022-33727 describes a vulnerability in the SecDevicePickerDialog onCreate prior to Samsung SMR Aug-2022 Release 1, where flawed UI handling enables a tapjacking/overlay attack to trick users into selecting an unwanted Bluetooth device. The issue is documented across multiple sources (NVD, Re...

CVE-2022-33723

CVE-2022-33723 concerns a vulnerable code path in the BluetoothScanDialog component on Android/Samsung devices. The issue is located in the onCreate method of BluetoothScanDialog, where an attacker could trick a user into selecting an unwanted Bluetooth device via a tapjacking/overlay attack. Aff...