CVE-2023-38293

CVE-2023-38293 concerns Nokia C200/C100 devices with a pre-installed com.tracfone.tfstatus app. It allows local third-party apps to inject and execute arbitrary AT commands in the radio context by exploiting two input/injection techniques via a broadcast to com.tracfone.tfstatus/.TFStatus, with n...

com.evenwell.fqc 安全漏洞

com.evenwell.fqc is a component. A security vulnerability exists in com.evenwell.fqc, which arises from the fact that certain software versions of the device contain a vulnerable pre-installed application com.evenwell.fqc that allows a native third-party application to execute arbitrary shell...

CVE-2023-38294

Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory versionCode='7', versionName='1.8.02203101027' that allows local third-party apps to execute arbitrary shell commands in its context syst...

CVE-2023-38290

CVE-2023-38290 affects BLU View 2 and Sharp Rouvo V Android devices due to a vulnerable pre-installed com.evenwell.fqc app. The issue: inadequate access control lets local third-party apps execute arbitrary shell commands in the app’s system context without special permissions, enabling actions s...

The vulnerability of the Azure AI Search search engine, related to the use of pre-installed credentials, allows a perpetrator to disclose protected information.

The vulnerability of the Azure AI Search search engine is related to the use of pre-installed credentials. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by security measures...

PT-2024-2812 · Microsoft · Azure Ai Search

Name of the Vulnerable Software and Affected Versions: Azure AI Search affected versions not specified Description: The issue is related to the use of pre-installed credentials in Azure AI Search, which can be exploited to disclose protected information. Recommendations: At the moment, there is n...

CVE-2024-28951

in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free...

CVE-2024-28951

in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free...

CVE-2024-28951 Arkcompiler runtime has a use after free vulnerability

in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free...

CVE-2024-28951

Summary: CVE-2024-28951 affects OpenHarmony v4.0.0 and earlier and is described as a local-use-after-free vulnerability in the Arkcompiler runtime that allows arbitrary code execution in pre-installed apps. The vulnerability is local, requires privileges, and has a high impact on confidentiality,...

CVE-2024-28951 Arkcompiler runtime has a use after free vulnerability

in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free...

PT-2024-22639 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 4.0.0 Description: The issue allows a local attacker to execute arbitrary code in pre-installed apps through use after free. Recommendations: For versions prior to 4.0.0, update to version 4.0.0 or later to resol...

The vulnerability of the microprogramming software for UniLogic Studio series UniStream-controlled programmable logic controllers, related to the use of pre-installed credentials, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the microprogramming software for UniLogic Studio series UniStream controllers is related to the use of pre-installed credentials. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2024-2275 · Unitronics · Unistream +2

Name of the Vulnerable Software and Affected Versions: Unitronics Unistream Unilogic versions prior to 1.35.227 Description: The issue is related to the use of hard-coded passwords, which may allow an attacker to disclose sensitive information embedded inside the device's firmware. This could...

Dell Digital Delivery Memory Misreference Vulnerability

Dell Digital Delivery is an application from Dell USA dedicated to Dell computer equipment for the online purchase of pre-installed software for computers. Dell Digital Delivery suffers from a memory misreference vulnerability that originates from a mix-up in the program's instructions responsibl...

The vulnerability of Schneider Electric EcoStruxure IT Gateway’s software for communicating with controlled devices stems from the use of pre-installed credentials. This allows a perpetrator to escalate their privileges.

The vulnerability of Schneider Electric EcoStruxure IT Gateway software for communication with controlled devices is related to the use of pre-installed credentials. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the software tools for optimizing production processes in Location Intelligence Perpetual Large, Perpetual Medium, Perpetual Non-Prod, Perpetual Small, SUS Large, SUS Medium, SUS Non-Prod, and SUS Small lies in their reliance on pre-installed database data. This allows attackers to gain full access to the software tools.

The vulnerability of the software tools for optimizing production processes in Location Intelligence Perpetual Large, Perpetual Medium, Perpetual Non-Prod, Perpetual Small, SUS Large, SUS Medium, SUS Non-Prod, and SUS Small is related to the use of pre-installed configuration data. Exploiting thi...

PT-2024-1621 · Unknown · Location Intelligence Sus Non-Prod +7

Name of the Vulnerable Software and Affected Versions: Location Intelligence Perpetual Large versions prior to V4.3 Location Intelligence Perpetual Medium versions prior to V4.3 Location Intelligence Perpetual Non-Prod versions prior to V4.3 Location Intelligence Perpetual Small versions prior to...

The vulnerability of the Vinchin Backup & Recovery software for backup and restoration operations, related to the use of pre-installed user accounts, allows a hacker to elevate their privileges to the level of a root user.

The vulnerability of the Vinchin Backup & Recovery software regarding backup and restoration is related to the use of pre-installed user accounts. Exploiting this vulnerability allows a malicious actor to elevate their privileges to root-level by connecting with the default SSH account...

The vulnerability of the software for managing and controlling access to corporate resources and IBM Security Verify Governance applications lies in the use of pre-installed user accounts, which allows attackers to expose sensitive information that should be protected.

The vulnerability of the software for managing and controlling access to corporate resources and applications of IBM Security Verify Governance is related to the use of pre-installed user accounts. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...