Information disclosure

In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

UBUNTU-CVE-2023-20917

In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2023-20962

CVE-2023-20962 affects Android 13, specifically the MediaVolumePreferenceController.java function getSliceEndItem, where an unsafe PendingIntent could start a foreground activity from the background. This enables local information disclosure without extra privileges and without user interaction. ...

PT-2023-17749 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-12L through Android-13 Description: The issue is related to improper input validation in the launchDeepLinkIntentToRight function of SettingsHomepageActivity.java. This could allow the launch of arbitrary activities,...

PT-2023-17750 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to the getSliceEndItem function in MediaVolumePreferenceController.java, where an unsafe PendingIntent could allow starting a foreground activity from the background. This could le...

CVE-2023-20962

In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from the background due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

GHSA-WXMQ-V9GX-75PG Moodle vulnerable to Cross-site Request Forgery

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

CVE-2023-28335

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

CVE-2023-28335

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

CVE-2023-28335

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

UBUNTU-CVE-2023-28335

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

Cross site request forgery (csrf)

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

CVE-2022-43863

creationtimestamp| type| source ---|---|--- 2023-03-23 01:36:09+00:00| seen| https://t.me/cibsecurity/60538...

CVE-2023-28335 Moodle: csrf risk in resetting all templates of a database activity

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

CVE-2023-28335 Moodle: csrf risk in resetting all templates of a database activity

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

CVE-2023-28331 Moodle: xss risk when outputting database activity filter data

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk...

CVE-2023-28331 Moodle: xss risk when outputting database activity filter data

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk...

CVE-2023-28335 Moodle: csrf risk in resetting all templates of a database activity

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...

WordPress Wbcom Designs – BuddyPress Activity Social Share Plugin <= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Wbcom Designs – BuddyPress Activity Social Share Type Plugin Vulnerable versions = 3.5.0 Fixed in 3.5.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-28694 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...

HookSpoofer A Novel Infostealer with Advanced Capabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary North Korea-linked hacking group Reaper has recently been observed engaging in surveillance of North Korean defectors. To receive real-time threat advisories, please follow HiveForce Labs on LinkedIn...