PT-2021-14251

Name of the Vulnerable Software and Affected Versions: Cybozu Remote Service version 3.1.8 Description: A cross-site script inclusion issue in the management screen allows a remote authenticated attacker to obtain stored product information when using Mozilla Firefox. Recommendations: For Cybozu...

CVE-2021-20807: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20798: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...

PT-2021-14254

Name of the Vulnerable Software and Affected Versions: Cybozu Remote Service version 3.1.8 Description: A cross-site scripting issue exists in the management screen, allowing a remote authenticated attacker to inject an arbitrary script. Recommendations: For Cybozu Remote Service version 3.1.8,...

CVE-2021-20805: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20800: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-0692

In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2021-0688

In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8....

CVE-2021-0688

In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8....

Race condition

In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8....

CVE-2021-0688

CVE-2021-0688 is a local privilege-escalation race-condition vulnerability in Android affecting PhoneWindowManager.lockNow (lock screen bypass). Exploitation could grant higher privileges without user interaction; impact is described as local escalation with user privileges needed. Affected Andro...

CVE-2021-0688: Concurrent Execution using Shared Resource with Improper Synchronization

In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8....

Researchers Discover UEFI Bootkit Targeting Windows Computers Since 2012

Cybersecurity researchers on Tuesday revealed details of a previously undocumented UEFI Unified Extensible Firmware Interface bootkit that has been put to use by threat actors to backdoor Windows systems as early as 2012 by modifying a legitimate Windows Boot Manager binary to achieve persistence...

Apple Pay vulnerable to wireless pickpockets

Researchers have shown that it is possible for attackers to bypass an Apple iPhones lock screen to access payment services and make contactless transactions. The issue, which only applies to Apple Pay and Visa, is caused by the use of so-called magic bytes, a unique code used to unlock Apple Pay...

About the security content of iOS 15.0.1 and iPadOS 15.0.1

About the security content of iOS 15.0.1 and iPadOS 15.0.1 This document describes the security content of iOS 15.0.1 and iPadOS 15.0.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

Apple iOS/macOS 授权问题漏洞

Apple iOS is a set of operating systems developed by Apple Inc. for mobile devices. Apple iOS/macOS suffers from an authorization issue vulnerability that stems from improper execution of the Siri lock screen. The vulnerability can be exploited by an attacker to view contacts via the lock screen...

The vulnerability of the OTRS ticket request review screen’s display, related to the lack of protective measures for the website structure, allows attackers to access confidential data.

The vulnerability of the OTRS ticket request review screen relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created email...

Huawei EulerOS: Security Advisory for screen (EulerOS-SA-2021-2447)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP2 : screen (EulerOS-SA-2021-2447)

According to the version of the screen package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service invalid write access and application crash or possibly...

CVE-2021-1835

This issue was addressed with improved checks. This issue is fixed in iOS 14.5 and iPadOS 14.5. A person with physical access to an iOS device may be able to access notes from the lock screen...