CVE-2024-49731

CVE-2024-49731 affects Wear OS on Pixel Watch during setup, where a logic error in apk-versions.txt can corrupt telemetry opt-in settings on other watches. Impact stated: local privilege escalation without additional execution privileges; user interaction is required to exploit. Documents consist...

DEBIAN-CVE-2025-38700

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsiconn-dddata only if memory is allocated In case of an ibfastregmr allocation failure during iSER setup, the machine hits a panic because iscsiconn-dddata is initialized unconditionally, even when n...

CVE-2025-38722 habanalabs: fix UAF in export_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in exportdmabuf As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland it's a...

CVE-2025-38700

Concrete details found in connected documents confirm CVE-2025-38700 affects the Linux kernel's SCSI libiscsi path (iscsi_conn->dd_data) during iSER setup when ib_fast_reg_mr allocation fails. The root cause is unconditional initialization of iscsi_conn->dd_data when dd_size may be 0, leadi...

CVE-2025-38700 scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsiconn-dddata only if memory is allocated In case of an ibfastregmr allocation failure during iSER setup, the machine hits a panic because iscsiconn-dddata is initialized unconditionally, even when n...

CVE-2025-41039 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'datasconfigadminlandingpage', 'datasconfigcurrency', 'datasconfigdbversion', 'datasconfigdefaultpagination',...

PT-2025-36089

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: A logic error in the code within setupAccessibilityServices of AccessibilityFragment.java may allow an attacker to hide an enabled accessibility service. This could lead to local escalation...

PT-2025-36084

Name of the Vulnerable Software and Affected Versions: Pixel Watch affected versions not specified Description: A logic error in the code may lead to corruption of telemetry opt-in settings on other watches during the setup of a new Pixel Watch. This could result in local escalation of privilege...

Linux Distros Unpatched Vulnerability : CVE-2023-37117

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP. CVE-2023-37117 Note that Nessus relies on the presence of...

drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay()

...

cifs: fix potential memory leaks in session setup

...

Creation of Temporary File With Insecure Permissions

Overview Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions in the getorcreatetmpdir function in fileutils.py. This enables an attacker who can write to /tmp to cause the execution of arbitrary .py files during environment setup. Remediation...

What Is a Passkey? Here’s How to Set Up and Use Them (2025)

Passkeys were built to enable a password-free future. Here's what they are and how you can start using them...

CVE-2023-21482

Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical attackers to install package through Galaxy store before completion of Setup wizard...

CVE-2023-21482

Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical attackers to install package through Galaxy store before completion of Setup wizard...

CVE-2023-21482

Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical attackers to install package through Galaxy store before completion of Setup wizard...

CVE-2023-21482

The Samsung Camera app contains a Missing authorization vulnerability that affects specific versions prior to 11.1.02.18 (Android 11), 12.1.03.8 (Android 12), and 13.1.01.4 (Android 13). The issue allows a physical attacker to install a package through Galaxy Store before the Setup wizard complet...

CVE-2023-21482

Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical attackers to install package through Galaxy store before completion of Setup wizard...

PT-2025-35674

Name of the Vulnerable Software and Affected Versions: Camera versions prior to 11.1.02.18 Camera versions prior to 12.1.03.8 Camera versions prior to 13.1.01.4 Description: A missing authorization issue exists in the Camera application. This allows a physical attacker to install a package throug...

SAMSUNG Camera 安全漏洞

SAMSUNG Camera is a Samsung camera application from Samsung South Korea. A security vulnerability exists in SAMSUNG Camera that stems from a lack of authorization and could allow a physical attacker to install packages through the Galaxy Store before the setup wizard completes...