UBUNTU-CVE-2023-34246

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot...

CVE-2023-34246 Doorkeeper Improper Authentication vulnerability

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot...

CVE-2023-34246

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot...

PT-2023-24770 · Unknown +2 · Doorkeeper +2

Name of the Vulnerable Software and Affected Versions: Doorkeeper versions prior to 5.6.6 Description: The issue concerns Doorkeeper, an OAuth 2 provider for Ruby on Rails and Grape, which automatically processes authorization requests without user consent for public clients that have been...

Doorkeeper 授权问题漏洞

Doorkeeper is an OAuth 2 authentication provider for Rails/Grape applications. An authorization issue vulnerability exists in Doorkeeper versions prior to 5.6.6, which stems from the automatic processing of authorization requests from previously approved public clients that do not require user...

Doorkeeper Improper Authentication vulnerability

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252section-8.6 the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously...

DEBIAN-CVE-2023-25729

Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already...

PUB-A-225880325

In updatePermissionTreeSourcePackage of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti...

CVE-2022-39075

There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission...

PT-2023-13686 · Zte · Zte Mobile Phones

Name of the Vulnerable Software and Affected Versions: ZTE mobile phones affected versions not specified Description: The issue allows for unauthorized access, potentially enabling a malicious application to delete system files without user permission after being installed on the phone...

CVE-2023-24597

OX App Suite before frontend 7.10.6-rev24 allows the loading without user consent of an e-mail message's remote resources during printing...

CVE-2023-24597

OX App Suite before frontend 7.10.6-rev24 allows the loading without user consent of an e-mail message's remote resources during printing...

CVE-2023-24597

OX App Suite before frontend 7.10.6-rev24 allows the loading without user consent of an e-mail message's remote resources during printing...

New tool allows you to opt out of Facebook's targeted advertising

After Meta Facebook and Instagram switched the legal basis for targeting advertising from automatic consent to opt-out, privacy watchdog noyb has built a tool for users to opt out of targeted advertising and various other claims made by Meta in an easy and legally sound way. After losing several...

CVE-2023-20971

In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from a logic error in the code and has the potential to gain dangerous privileges without the user's consent...

CVE-2023-20971

In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions without user consent due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

PT-2023-17759 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a logic error in the removePermission method of PermissionManagerServiceImpl.java, which could allow obtaining dangerous...

Mozilla: Extensions could have opened external schemes without user knowledge

The Mozilla Foundation Security Advisory describes this flaw as: Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such...

Four EU telco giants will start asking users if they want personalized targeted ads

They say you can't have too much of a good thing. Unfortunately, this applies to ads, too, whether you think they're a good thing or not. Soon, Europes four biggest telecommunication companies--Germany's Deutsche Telekom DK, France's Orange, Spain's Telefonica, and the UK's Vodafone Group--will...